# REPORT — v0.127.1: escrow wizard polish (CTA visibility, Hungarian preflight, typed-back highlight, blur-on-verify)

**Date:** 2026-07-13 · **Version:** controller v0.127.1 (from v0.127.0, baseline `a5041da` confirmed) · Presentation-only; MinAgent unchanged (0.88.0 for the wizard); agent/felhom.eu untouched. Commit `156e7d5` on `main`. Source: four findings from Viktor's supervised wizard passes (drill + demo).

## Files changed

- `controller/internal/web/templates/backups_remote.html` — Part 1: the escrowed-state
  "Új helyreállítási kód készítése" CTA is a real `btn btn-sm btn-outline` secondary button
  (outline, deliberately NOT primary — escrowed is healthy/available-not-urgent; the stale
  variant keeps its primary CTA). Hint line kept above it; `{{if .EscrowAgentOK}}` gate kept.
- `controller/internal/web/templates/backups_escrow.html` —
  - Part 2: `pfDetail()` + `PF_FAIL_DETAILS` map the agent's operator-English preflight `detail`
    strings to Hungarian per the spec table (OK rows: value-bearing details only — storage id,
    age path, "előkészítve"; boolean-OK rows: no detail; not-OK rows: Hungarian text + the raw
    agent detail in a muted `var(--text-3)` diagnostic span; unknown ids fall back to the raw
    detail — a failure is never blanked; `staged_secret` keeps its informational dot).
  - Part 3: span-per-word code rendering (`createElement` + `textContent` + `createTextNode`
    ONLY — R still never flows through innerHTML; comment documents why the spans keep the same
    no-parse-context guarantee); the two typed-back words highlighted `var(--warn)`/600;
    `verifyIdx` now chosen BEFORE rendering; `finishWizard`'s `textContent=''` verified to clear
    the child spans.
  - Part 4 (optional — implemented, trivially strikeable): first focus on either verification
    input blurs the code (`filter: blur(6px)`, inline-style toggle — no style.css edit, no
    cache-bust needed) + a `btn-ghost` "Megjelenítés"/"Elrejtés" local toggle, so the typed-back
    exercises the WRITTEN copy. R stays in the JS closure throughout.
- `controller/internal/web/escrow_wizard_test.go` — render assertions: the btn-outline CTA
  markup on the escrowed card; the Hungarian not-staged + sudo-missing strings; the blur toggle
  label; and the three raw English literals ("DR tier applied", "hub upload target configured",
  "sudo grant listed") asserted ABSENT from the page source.
- `CHANGELOG.md` — v0.127.1 entry.

## Tests + gates

`go build ./... && go vet ./... && go test ./...` — green (502 test funcs, no count change:
existing render test extended). All four UI gates green (template_id, emoji, native-confirm,
offbox-rename). **§10 red-proofs: N/A** — presentation-only, no correctness/security fix
(stated per the task). JS runtime behavior (span construction, blur toggle) is covered by code
review + the render-source assertions; **the visual leg (steps 5–6 highlight + blur) awaits
Viktor's eyeball pass on his next login** — no ceremony was run anywhere (§12: the demo and
drill boxes hold fresh real recovery codes; a run would supersede them).

## Deployed

| Target | Verification |
|---|---|
| demo 9201 | `gitea.dooplex.hu/admin/felhom-controller:0.127.1 Up (healthy)`; startup log clean, `controller_started (0.127.1)` event pushed |
| drill guest (qm 300) | `gitea.dooplex.hu/admin/felhom-controller:0.127.1 Up (healthy)`; startup log clean |

## Observations
- The wizard page embeds its Hungarian detail map in page JS — if the agent ever adds a seventh
  preflight item id, the fallback renders its raw detail (by design); add the Hungarian pair in
  the same commit that adds the id.
- The stale-card CTA remains `btn-primary` (urgent) — only the healthy escrowed state was
  demoted to outline; the pending card's primary CTA is also unchanged.