v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

Off-site backup is ON by default and does not RUN until the household creates its
recovery code. The pause is the zero-knowledge escrow design and is untouched here;
what was missing is that nothing ASKED, while the app-backup page promised the very
copy that had never run.

- a reminder bar on every authenticated page while the off-site tier is configured
  and its escrow is not complete, linking /backup/escrow. It is the R-241 bar, second
  instance: same session-cookie dismissal, back next visit, gone for good when
  escrowed. No second banner system. It hangs off executeTemplate, the single render
  choke point, so it cannot reach only the pages someone remembered.
- the tier-1 file sentence renders by tier3State's own vocabulary instead of the
  app's shape: active -> "vedi", escrow_pending -> "vedene ... szunetel" + the route,
  no copy at all -> says so and names both ways out.
- both fixes red-proofed: the bar test fails on BOTH pages with the hook removed; the
  sentence test quotes the exact v0.244.0 promise when the state is ignored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,36 @@
+## v0.245.0 — the household is asked for the recovery code, and the page says „szünetel" until then (2026-09-16, R-543)
+
+**MinAgent: 0.131.0** (unchanged — nothing here needs a newer agent)
+
+- **R-543 — off-site backup is ON by default and does NOT RUN until the household creates its
+  recovery code, and nothing anywhere asked them to.** The pause is the DESIGN, not a defect: the
+  escrow is zero-knowledge (07-backup-architecture §6.3), the household's code is the only key, and a
+  run started without one would produce a copy nobody could ever open. Nothing in this release
+  touches that mechanism. What was missing is the ASKING. Measured on a fresh box 2026-09-16: the
+  off-site tier sat at „Kulcsletétre vár" from the first minute, no snapshot was ever written, and
+  the app-backup page told the household their files were protected by that very copy.
+  - **A reminder bar on every dashboard page** while the off-site tier is configured and its escrow
+    is not complete: „A távoli mentés szünetel, amíg nem hozod létre a helyreállítási kódot." with
+    the route to `/backup/escrow`. It is the **R-241 bar, second instance** — same session-cookie
+    dismissal („Most nem"), back at the next visit, gone for good when the state is `escrowed`. **No
+    second banner system was built.** It hangs off `executeTemplate`, the single render choke point,
+    so it reaches every authenticated page rather than the three pages a per-handler helper would
+    have covered; the login and claim pages render through `ExecuteTemplate` directly and never pass
+    through it, and a session check keeps it off the public guest share page.
+  - **The tier-1 sentence now renders by STATE, not by the app's shape.** v0.244.0 fixed the label
+    (R-537) and put a new promise in its place: „a távoli másolat … védi", printed whenever an app
+    keeps files on the drive. On a paused box that named a protection which had never run once. It
+    now reads „…**védené** — a távoli mentés a helyreállítási kód létrehozásáig szünetel" with the
+    route out; with no off-site and no second drive it says there is no copy and names both ways to
+    get one. It takes `tier3State`'s own vocabulary rather than re-deriving the state, so the row and
+    the sentence cannot disagree.
+  - Red-proofs, each seen failing: delete the one `addEscrowBanner` line from `executeTemplate` →
+    `TestR543_A_PausedBoxAsksOnEveryPage` fails on BOTH pages („does not tell the household the
+    off-site copy is PAUSED"); compute the sentence from the app's shape alone as v0.244.0 did →
+    `TestR543_Tier1Sentence_PausedStateDoesNotPromise` fails quoting the exact promise a fresh box
+    read all day. Negative controls: an escrowed box is not nagged, an unconfigured box is not
+    nagged, and an app with no drive-side files gets no sentence in any state.
+
 ## v0.244.0 — the backup page stops promising what it does not hold, and a restore refuses to lie (2026-09-16, R-537 / R-538 / R-536)
 
 **MinAgent: 0.131.0** (unchanged — nothing here needs a newer agent)