v0.127.2: wizard code hide is manual-only — drop the v0.127.1 auto-blur-on-focus (customers type the verification words from the screen); Elrejtés/Megjelenítés toggle shown from reveal, never automatic

CHANGELOG.md

@@ -1,5 +1,12 @@
 ## Changelog
 
+### v0.127.2 — wizard code hide is MANUAL-only (2026-07-13, Viktor's live finding on v0.127.1)
+
+The v0.127.1 blur-on-verify auto-blurred the code the moment a verification input got focus —
+which made typing the two words HARDER, since the customer types them from the screen. Reversed:
+the code stays visible; the "Elrejtés"/"Megjelenítés" toggle appears with the reveal and is
+manual-only (still useful for a screen share). Render test asserts no `onfocus` auto-blur remains.
+
 ### v0.127.1 — escrow wizard polish: CTA visibility + Hungarian preflight + typed-back highlight + blur-on-verify (2026-07-13)
 
 Four findings from Viktor's first supervised wizard passes (drill + demo). Presentation-only —

controller/internal/web/escrow_wizard_test.go

@@ -325,15 +325,22 @@ func TestEscrowTemplates_Render(t *testing.T) {
 			"Ez a kód többé nem jeleníthető meg.",
 			"nem ezen a szerveren",
 			"biztonsági okból újra nem kérhető le",
-			// v0.127.1 polish: the Hungarian preflight detail map + the blur-on-verify toggle.
+			// v0.127.1 polish: the Hungarian preflight detail map + the hide/show toggle
+			// (v0.127.2: manual-only — initial label "Elrejtés", code visible by default).
 			"nincs előkészített jelszó — a varázsló indításkor automatikusan előkészíti",
 			"a rendszerjogosultság hiányzik",
 			"Megjelenítés",
+			">Elrejtés</button>",
 		} {
 			if !strings.Contains(html, want) {
 				t.Errorf("wizard missing %q", want)
 			}
 		}
+		// v0.127.2 (Viktor's live finding): the code must NOT auto-blur when a verification input
+		// gets focus — the customer types from the screen. The hide toggle is manual-only.
+		if strings.Contains(html, "armCodeBlur") || strings.Contains(html, "onfocus=") {
+			t.Error("auto-blur-on-focus must be gone (manual toggle only)")
+		}
 		if strings.Contains(html, "érvényét veszti") {
 			t.Error("fresh wizard must not show the re-ceremony supersede warning")
 		}

controller/internal/web/templates/backups_escrow.html

@@ -71,13 +71,13 @@
     <div id="reveal-shown" style="display:none">
         <div class="alert alert-warning" style="margin-bottom:.5rem">Ez a kód többé nem jeleníthető meg.</div>
         <pre class="mono" id="code-block" style="white-space:pre-wrap;word-break:break-all;background:var(--bg-0);border:1px solid var(--line);border-radius:var(--radius);padding:1rem;font-size:1.05rem"></pre>
-        <button type="button" class="btn btn-ghost btn-sm" id="code-blur-toggle" style="display:none" onclick="toggleCodeBlur()">Megjelenítés</button>
+        <button type="button" class="btn btn-ghost btn-sm" id="code-blur-toggle" onclick="toggleCodeBlur()">Elrejtés</button>
         <h3 style="margin-top:1.25rem">6. Ellenőrzés</h3>
         <div class="form-group">
             <label id="verify-label" for="verify-w1">Megerősítés: írja be a kód szavait</label>
             <div style="display:flex;gap:.5rem">
-                <input type="text" id="verify-w1" class="form-control" autocomplete="off" style="max-width:180px" onfocus="armCodeBlur()">
-                <input type="text" id="verify-w2" class="form-control" autocomplete="off" style="max-width:180px" onfocus="armCodeBlur()">
+                <input type="text" id="verify-w1" class="form-control" autocomplete="off" style="max-width:180px">
+                <input type="text" id="verify-w2" class="form-control" autocomplete="off" style="max-width:180px">
             </div>
             <div id="verify-error" class="alert alert-error" style="display:none;margin-top:.5rem">A megadott szavak nem egyeznek — ellenőrizze a felírt kódot.</div>
         </div>
@@ -254,16 +254,12 @@ async function claimCode(){
   }catch(e){ errEl.textContent='Hiba: '+e.message; errEl.style.display='block'; btn.disabled=false; }
 }
 
-// Blur-on-verify (v0.127.1, Part 4): the typed-back should exercise the WRITTEN copy, not screen
-// transcription — the first focus on a verification input blurs the code and offers a local
-// show/hide toggle. R stays in the JS closure throughout; the blur is pure presentation.
-var codeBlurred=false, blurArmed=false;
-function armCodeBlur(){
-  if(blurArmed){ return; }
-  blurArmed=true;
-  setCodeBlur(true);
-  document.getElementById('code-blur-toggle').style.display='inline-block';
-}
+// Manual hide toggle (v0.127.2 — Viktor's live finding reversed the v0.127.1 auto-blur: blurring
+// the code the moment a verification input gets focus made typing the words HARDER, since most
+// customers type from the screen. The code now stays visible; "Elrejtés" is offered from the
+// reveal onward for when hiding is wanted, e.g. a screen share). R stays in the JS closure;
+// the blur is pure presentation.
+var codeBlurred=false;
 function setCodeBlur(on){
   codeBlurred=on;
   document.getElementById('code-block').style.filter=on?'blur(6px)':'';