The new escrow package reaches the hub only after the household typed two words of the code back: POST /escrow/ceremony/confirm; an old controller keeps the claim order (R-1151, unreleased)

internal/localapi/server.go

@@ -439,7 +439,14 @@ type Server struct {
 	escrowClaiming bool   // R-978: a claim is uploading escrowPending (TTL and a new start wait)
 	escrowRClaimed bool
 	escrowRExpiry  time.Time
-	escrowDone     <-chan struct{} // closes when the detached job finishes (tests wait on it)
+	// R-1151: after a claim that asked to wait for the typed-back words (defer_upload), the package stays in
+	// escrowPending until POST /escrow/ceremony/confirm brings the two words at escrowConfirmPos back. Only those two
+	// words are kept (never R), zeroed on confirm, supersede and expiry.
+	escrowAwaitConfirm  bool
+	escrowConfirmWords  [2][]byte
+	escrowConfirmPos    [2]int
+	escrowConfirmExpiry time.Time
+	escrowDone          <-chan struct{} // closes when the detached job finishes (tests wait on it)
 	// ceremonyRun executes the fixed-argv sudo self-invocation (tests inject canned JSON).
 	ceremonyRun ceremonyRunner
 	privileged  PrivilegedRunner
@@ -614,6 +621,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /escrow/ceremony", s.withGuest(s.handleEscrowCeremonyStart))
 	mux.HandleFunc("GET /escrow/ceremony/status", s.withGuest(s.handleEscrowCeremonyStatus))
 	mux.HandleFunc("POST /escrow/ceremony/claim", s.withGuest(s.handleEscrowCeremonyClaim))
+	// R-1151: the household typed two words of the new code back — only now does its package reach the hub.
+	mux.HandleFunc("POST /escrow/ceremony/confirm", s.withGuest(s.handleEscrowCeremonyConfirm))
 
 	// v0.83.0 observability: the agent's always-DEBUG capture ring, for the controller's
 	// Debug page agent tab (same auth/self-scoping wrap as every sibling route).