The escrow wizard sends the typed-back words to the box; the new package reaches the hub only when they match (R-1151 controller half, unreleased; works with every agent)

CHANGELOG.md

@@ -1,3 +1,26 @@
+## Unreleased (2026-10-19) — the new recovery code replaces the old one only after the household typed it back (R-1151, controller half)
+
+Ships in the next release. **No new MinAgent:** it works with every agent — the agent's claim answer says whether a
+confirm is needed.
+
+- **The wizard's typed-back words now go to the box, not only to the browser.** The claim asks the agent to keep the
+  new package (`{"defer_upload": true}`); an agent ≥ 0.160.0 answers with `confirm_required` and the two word
+  positions (it draws them now; the page drew them before), and the page's „Szavak ellenőrzése" posts the two words to
+  the new `POST /api/escrow/confirm` (session + CSRF, like the other `/api/escrow/*` calls), which hands them to the
+  agent's `POST /escrow/ceremony/confirm`. Only a match stores the new package on the hub; until then the ceremony is not
+  complete (no „completed" stamp, no report push — both moved from the claim to the confirm). Answers: wrong words →
+  422, the page says so and the wait goes on; the agent's window ran out (410) or nothing waits any more (404 — a new
+  start, an agent restart) → 410 with `restart`, the page clears the code and offers „Újraindítás"; a hub failure →
+  502, try again. Every answer says the previous code still works where it does. New keys
+  `api.escrow.confirm_expired`, `confirm_lost`, `confirm_store_failed`, `confirm_words_mismatch` (hu + en).
+  **An agent older than 0.160.0** ignores the claim's body and stores the package at the claim, as before; its answer
+  has no `confirm_required`, so the page keeps its own check and the claim completes the ceremony (pinned).
+  Tests `TestR1151_ClaimThatWaitsIsNotCompleteUntilTheWordsComeBack`, `TestR1151_OldAgentClaimCompletesAtOnce`,
+  `TestR1151_ConfirmAnswersInTheBoxLanguage`, `TestEscrowClaimAndConfirm_R1151` (agentapi). Red-proved: the
+  `ConfirmRequired` branch removed → `claim: 200 {"data":{"recovery_code":…}}` with no confirm request. i18n fixtures
+  changed (named): `escrow_first`, `escrow_receremony` (the page's script and the hidden „Újraindítás" link); every
+  other fixture byte-identical.
+
 ## v0.331.0 — OnlyOffice opens and SAVES from FileBrowser and Nextcloud; FileBrowser is back at once after a restart (R-1018); a removal deletes a volume the definition dropped (R-1117) (2026-10-18)
 
 **MinAgent: 0.158.1** — the floor's, carried (not above the vouched agent 0.159.2). Nothing here calls a new agent route.