The escrow wizard sends the typed-back words to the box; the new package reaches the hub only when they match (R-1151 controller half, unreleased; works with every agent)

controller/internal/agentapi/escrow.go

@@ -92,31 +92,63 @@ func (c *Client) EscrowCeremonyStatus(ctx context.Context) (EscrowCeremonyStatus
 	return out, nil
 }
 
+// EscrowClaim is a claimed recovery code. ConfirmRequired (agent ≥ 0.160.0, R-1151): the code's package reaches the
+// hub only when EscrowCeremonyConfirm brings back the words at Positions (1-based); an older agent answers without
+// it — its package is already on the hub, and no confirm is needed.
+type EscrowClaim struct {
+	Code            string
+	ConfirmRequired bool
+	Positions       []int
+}
+
 // EscrowCeremonyClaim performs the ONE-SHOT R claim. Returns the recovery code + the agent's
 // HTTP status (410 = already claimed / expired — the wizard's void state). The code must never
 // be logged, persisted, or placed anywhere but the claim XHR response; the error path carries
 // the agent's reason text, never the code.
-func (c *Client) EscrowCeremonyClaim(ctx context.Context) (string, int, error) {
-	env, status, err := c.postWithStatus(ctx, "/escrow/ceremony/claim", struct{}{})
+//
+// R-1151: the claim asks the agent to keep the new package until the household typed the code back
+// (`defer_upload`). An agent older than 0.160.0 ignores the body and uploads as before.
+func (c *Client) EscrowCeremonyClaim(ctx context.Context) (EscrowClaim, int, error) {
+	env, status, err := c.postWithStatus(ctx, "/escrow/ceremony/claim", map[string]bool{"defer_upload": true})
 	if err != nil {
-		return "", status, err
+		return EscrowClaim{}, status, err
 	}
 	if status == http.StatusGone {
-		return "", status, fmt.Errorf("agentapi: POST /escrow/ceremony/claim: gone (claimed or expired)")
+		return EscrowClaim{}, status, fmt.Errorf("agentapi: POST /escrow/ceremony/claim: gone (claimed or expired)")
 	}
 	if err := refusalError("/escrow/ceremony/claim", status, env); err != nil {
-		return "", status, err
+		return EscrowClaim{}, status, err
 	}
 	var out struct {
-		RecoveryCode string `json:"recovery_code"`
+		RecoveryCode    string `json:"recovery_code"`
+		ConfirmRequired bool   `json:"confirm_required"`
+		VerifyPositions []int  `json:"verify_positions"`
 	}
 	if err := json.Unmarshal(env.Data, &out); err != nil {
-		return "", status, fmt.Errorf("agentapi: decode /escrow/ceremony/claim: %w", err)
+		return EscrowClaim{}, status, fmt.Errorf("agentapi: decode /escrow/ceremony/claim: %w", err)
 	}
 	if out.RecoveryCode == "" {
-		return "", status, fmt.Errorf("agentapi: /escrow/ceremony/claim returned no code")
+		return EscrowClaim{}, status, fmt.Errorf("agentapi: /escrow/ceremony/claim returned no code")
 	}
-	return out.RecoveryCode, status, nil
+	if out.ConfirmRequired && len(out.VerifyPositions) != 2 {
+		return EscrowClaim{}, status, fmt.Errorf("agentapi: /escrow/ceremony/claim asks for a confirmation without two positions")
+	}
+	return EscrowClaim{Code: out.RecoveryCode, ConfirmRequired: out.ConfirmRequired, Positions: out.VerifyPositions}, status, nil
+}
+
+// EscrowCeremonyConfirm sends the two words the household typed back (R-1151, agent ≥ 0.160.0); on success the agent
+// has stored the new package on the hub. The status is returned for the caller to classify: 422 the words do not
+// match (still waiting), 410 the window ran out, 404 nothing waits (superseded, restarted), 502 the hub failed (still
+// waiting). The words are part of the recovery code — never logged.
+func (c *Client) EscrowCeremonyConfirm(ctx context.Context, words []string) (int, error) {
+	env, status, err := c.postWithStatus(ctx, "/escrow/ceremony/confirm", map[string][]string{"words": words})
+	if err != nil {
+		return status, err
+	}
+	if err := refusalError("/escrow/ceremony/confirm", status, env); err != nil {
+		return status, err
+	}
+	return status, nil
 }
 
 // RecoverOffsiteRepoPassword asks the agent to open this host's hub-held sealed bundle with the