v0.127.1: escrow wizard polish — escrowed-card CTA as btn-outline, Hungarian preflight detail map (raw agent English only as muted failure diagnostic), typed-back word highlight (span-per-word, textContent-only), blur-on-verify toggle

CHANGELOG.md

@@ -1,5 +1,34 @@
 ## Changelog
 
+### v0.127.1 — escrow wizard polish: CTA visibility + Hungarian preflight + typed-back highlight + blur-on-verify (2026-07-13)
+
+Four findings from Viktor's first supervised wizard passes (drill + demo). Presentation-only —
+no endpoint, agent call, or state change; §10 red-proofs N/A.
+
+- **Escrowed-card CTA** (`backups_remote.html`): "Új helyreállítási kód készítése" is a real
+  `btn btn-sm btn-outline` secondary button (was an inline link inside the muted hint — nearly
+  invisible). Outline, NOT primary: escrowed is healthy, the CTA is available-not-urgent (the
+  stale variant stays primary). Render-tested.
+- **Hungarian preflight details** (`backups_escrow.html` `pfDetail`): the agent's operator-English
+  `detail` strings no longer leak into the customer UI. OK rows keep only VALUE details (storage
+  id, age path; `staged_secret` → "előkészítve"); boolean-OK rows (dr_tier/hub_upload/sudo_grant)
+  render no detail; not-OK rows get the Hungarian explanation + the raw agent detail as a muted
+  diagnostic span; unknown ids fall back to the raw detail (never blank a failure);
+  `staged_secret` keeps its informational dot. Render test pins the not-staged copy + asserts the
+  three English literals never appear in the page source.
+- **Typed-back highlight**: the code renders as span-per-word (createElement + textContent +
+  createTextNode ONLY — R still never flows through innerHTML; no parse context = no injection
+  surface); the two verification words get `var(--warn)` + 600 weight so they're findable on
+  paper. `verifyIdx` is now chosen BEFORE rendering. `finishWizard`'s `textContent=''` clears the
+  spans (child-node replacement — verified).
+- **Blur-on-verify** (Part 4, optional — implemented; trivial to strike): first focus on either
+  verification input blurs the code (`filter: blur(6px)`, inline-style toggle — no style.css
+  change, no cache-bust) + a `btn-ghost` "Megjelenítés"/"Elrejtés" toggle. The typed-back now
+  exercises the WRITTEN copy, not screen transcription. R stays in the JS closure.
+
+JS behavior (spans/blur) is review-covered; the visual leg awaits Viktor's next login. All four
+UI gates green.
+
 ### v0.127.0 — customer-facing escrow ceremony wizard + stale-blob re-check (2026-07-13) — MinAgent: 0.88.0 (wizard only; everything else unchanged)
 
 The missing friend-alpha piece: the recovery-code ceremony moves from operator-SSH to a