  session=64 csrf=64
  --- preflight ---
{"data":{"agent_supported":true,"escrow_state":"pending","items":[{"id":"pbs_storage_id","ok":true,"detail":"felhom-pbs"},{"id":"dr_tier","ok":true,"detail":"DR tier applied"},{"id":"age_binary","ok":true,"detail":"/usr/bin/age"},{"id":"hub_upload","ok":true,"detail":"hub upload target configured"},{"id":"staged_secret","ok":true,"detail":"staged secret present"},{"id":"sudo_grant","ok":true,"deta
  --- start (re-authenticates with the dashboard password) ---
  POST /api/escrow/start -> 200
{"data":{"job_id":"escrow-1789591140971464235","phase":"running"},"error":"","ok":true}

  --- poll ---
   {"data":{"claim_expires_in_sec":598,"claimable":true,"claimed":false,"detail":"","entropy_bits":129.24070185585344,"job_id":"escrow-1789591140971464235","key_fingerprint":"6b:ca:5f:3f:ca:0f:e2:3f:fb:2
  --- claim (ONE-SHOT reveal; value goes to a file, never to stdout) ---
  POST /api/escrow/claim -> 200
  recovery code claimed: 83 chars, 10 words — written to a file, NOT printed
  --- escrow state after the ceremony ---

## THE ANSWER: the gap is a TIMING gap, and the box closes it BY ITSELF
The watcher left the box alone and polled. Nothing was pressed.

  20:30:12Z  pbs_storage=none        escrow.pbs_storage_id=none
  20:31:13Z  pbs_storage=none        escrow.pbs_storage_id=none
  20:32:14Z  pbs_storage=none        escrow.pbs_storage_id=none
  20:33:15Z  pbs_storage=none        escrow.pbs_storage_id=none
  20:34:15Z  pbs_storage=none        escrow.pbs_storage_id=none
  **20:35:16Z  pbs_storage=felhom-pbs  escrow.pbs_storage_id=felhom-pbs   -> CONVERGED**

That is **~17 minutes after the bind** (20:18:15Z) and ~6 minutes after the ceremony first refused.
The retry then passed every preflight item:
  pbs_storage_id ok (felhom-pbs) · dr_tier ok (DR tier applied) · age_binary ok (/usr/bin/age)
  · hub_upload ok · staged_secret ok · sudo_grant ok · agent_supported true · escrow_state pending

  POST /api/escrow/start  -> 200, job escrow-1789591140971464235, phase running
  GET  /api/escrow/status -> claimable:true, entropy_bits 129.2, key fingerprint 6b:ca:5f:3f:…
  POST /api/escrow/claim  -> **200** — the recovery code, 83 characters / 10 words, revealed ONCE
       (written to a 0600 file; not printed, not committed — the household writes it on paper)

**So the product is not broken here, and the fix shipped tonight is not wrong — the GUIDE's timing
is.** `VOLUNTEER-first-hour.md` §6 (written a few hours ago) places the recovery code immediately
after the dashboard password and before the first app. On a fresh box that moment is inside the
~17-minute window where the agent has not yet applied the DR descriptor, so a volunteer following the
guide literally meets „exit 2: selftest=escrow-create requires -storage <pbs-storage-id>" and a 409,
with nothing on the page telling them to simply wait a quarter of an hour.

The escrow reminder bar (R-543, also shipped tonight) makes this sharper rather than softer: it is on
every page urging the household to do the very thing that cannot yet be done.

## The state flipped: escrow_state = **escrowed**
Read from the box's own settings after the ceremony:
    enabled=True  host=u629488-sub4.your-storagebox.de
    **escrow_state=escrowed**
    last_run=None  last_status=None  snapshot_count=None   (never run yet — honest, not "0")

„Claimed" and „escrowed" are different facts: the claim is the household seeing the code once, the
flip to `escrowed` happens when the hub's ACK confirms `sha256(local repo_password)` matches the
stored escrow. Both happened. The off-site tier is therefore ARMED for the first time on this box,
and the escrow reminder bar shipped tonight should now be gone from every page — which the first
round will read back rather than assume.

## An alarm caused by MY recovery, flagged so it is never scored as a round's alarm
    Sep 16 20:39  **error  storage_disconnected**  „Meghajtó váratlanul leválasztva: Adatlemez"
That is the guest restart I performed to clear the read-only wedge. It is a TRUE alarm — the drive
really did go away for those seconds — but it belongs to my repair, not to any accident in the
schedule. Round 11's drawn accident is `drive pulled 20min`, and when that round is scored this
20:39 event must not be mistaken for it.
