R-1254 (controller half): escrow claim/confirm outwait the agent (60 s); an unknown confirm outcome promises nothing

504 from the agent (it cannot learn which package the hub holds) or a failed call -> api.escrow.confirm_store_unknown
(hu+en); only 502 keeps 'your previous code still works'. Tests TestR1254_* red before the fix. Commit only.

controller/internal/web/escrow_handlers.go

@@ -352,6 +352,12 @@ func (s *Server) escrowConfirmAPIHandler(w http.ResponseWriter, r *http.Request)
 			escrowJSON(w, http.StatusGone, map[string]any{"restart": true}, s.msg(r, "api.escrow.confirm_expired"))
 		case http.StatusNotFound:
 			escrowJSON(w, http.StatusGone, map[string]any{"restart": true}, s.msg(r, "api.escrow.confirm_lost"))
+		case http.StatusGatewayTimeout, 0:
+			// R-1254 H2: the agent could not learn which package the hub holds (504), or this call itself failed (0 — it may
+			// have timed out while the agent still stored the package). Either way the new package MAY be on the hub: no
+			// promise about the previous code. Only 502 (the hub holds another package) keeps the store-failed sentence.
+			s.logger.Printf("[WARN] [web] escrow confirm outcome unknown (status %d)", status)
+			escrowJSON(w, http.StatusGatewayTimeout, nil, s.msg(r, "api.escrow.confirm_store_unknown"))
 		default:
 			s.logger.Printf("[WARN] [web] escrow confirm failed (status %d)", status)
 			escrowJSON(w, http.StatusBadGateway, nil, s.msg(r, "api.escrow.confirm_store_failed"))

controller/internal/web/r1151_escrow_confirm_test.go

@@ -93,7 +93,9 @@ func TestR1151_ConfirmAnswersInTheBoxLanguage(t *testing.T) {
 		{http.StatusGone, http.StatusGone, true, "Lejárt az idő", "has run out"},
 		{http.StatusNotFound, http.StatusGone, true, "már nem vár megerősítésre", "no longer waits"},
 		{http.StatusBadGateway, http.StatusBadGateway, false, "nem sikerült elmenteni", "could not be saved"},
-		{0, http.StatusBadGateway, false, "nem sikerült elmenteni", "could not be saved"},
+		// R-1254 H2 (2026-10-28): a failed call (0) or an agent that cannot learn the outcome (504) promises nothing.
+		{0, http.StatusGatewayTimeout, false, "Nem tudjuk biztosan", "cannot tell yet"},
+		{http.StatusGatewayTimeout, http.StatusGatewayTimeout, false, "Nem tudjuk biztosan", "cannot tell yet"},
 	}
 	for _, c := range cases {
 		for _, lang := range []string{"hu", "en"} {

controller/internal/web/r1254_escrow_outcome_test.go

@@ -0,0 +1,48 @@
+package web
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// R-1254 H2 (the household's sentence): a confirm whose upload answer is late or lost must not promise „your previous
+// code still works" — the hub may hold the new package. Since agent 0.168.0 the agent asks the hub and answers 502 only
+// when the hub holds ANOTHER package; 504 = unknown. A controller-side transport failure (status 0 — the call itself
+// timed out while the agent may still store) is unknown too.
+// RED-PROOF: drop the 504/0 case from escrowConfirmAPIHandler → the default sentence („a régi kódod továbbra is
+// érvényes") is shown → FAILS.
+func TestR1254_AnUnknownConfirmOutcomePromisesNothing(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+	}{{"agent 504", http.StatusGatewayTimeout}, {"transport failure", 0}} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newEscrowWizardHarness(t)
+			h.configureOffbox(t, "pending")
+			h.agent.confirmStatus, h.agent.confirmErr = tc.status, errors.New("late")
+			for _, lang := range []string{"hu", "en"} {
+				w := postConfirm(t, h.s, lang, `{"words":["ketto","negy"]}`)
+				low := strings.ToLower(w.Body.String())
+				// ASCII fragments (the accented forms carry these stems): „régi kódod továbbra is érvényes" / „still works".
+				if strings.Contains(low, "tovabbra is") || strings.Contains(low, "továbbra is") || strings.Contains(low, "still works") {
+					t.Fatalf("%s: an unknown outcome promised the previous code: %s", lang, w.Body.String())
+				}
+				if !strings.Contains(low, "mindket") && !strings.Contains(low, "mindkét") && !strings.Contains(low, "both") {
+					t.Fatalf("%s: the sentence must tell the household to keep both codes: %s", lang, w.Body.String())
+				}
+			}
+			if ceremonyStamped(t, h) {
+				t.Fatal("an unknown outcome stamped the ceremony completed")
+			}
+		})
+	}
+	// Control: the agent says the hub holds another package (502) → the old sentence, now true.
+	h := newEscrowWizardHarness(t)
+	h.configureOffbox(t, "pending")
+	h.agent.confirmStatus, h.agent.confirmErr = http.StatusBadGateway, errors.New("not stored")
+	if w := postConfirm(t, h.s, "en", `{"words":["ketto","negy"]}`); !strings.Contains(w.Body.String(), "still works") {
+		t.Fatalf("502 must keep the store-failed sentence: %s", w.Body.String())
+	}
+}