hub v0.163.0: a rebuilt box gets the household's sealed package back (R-1176); one run per daily job on clock-change days (R-1183); a scoped abandonment purge (R-1182); the new-link page says the old box is still linked (R-1203)

hub/internal/notify/dispatcher.go

@@ -849,6 +849,14 @@ var operatorOnlyEvents = map[string]bool{
 	// mints the type — an operator-tier type absent from this register reaches customers as raw
 	// English (the v0.78.0 defect recorded above).
 	"escrow_blob_served": true,
+	// R-1176 (2026-10-21): a household's sealed package was carried to its rebuilt box, or the carry was refused
+	// because the customer has two live hosts. Host ids and a hash; the operator acts, the household cannot.
+	// Registered in the same commit that mints the types.
+	"escrow_carried":       true,
+	"escrow_carry_refused": true,
+	// R-1203 (2026-10-21): a household asked for a new box link while its old host is still linked — the operator
+	// gets the host name to delete. Registered in the same commit that mints the type.
+	"bind_old_host_linked": true,
 	// R-523 (v0.114.0). The agent restarted a dead in-guest controller, or gave up after repeated
 	// restarts. Operator-grade (host ids, vmids, raw docker states) and not actionable by a household
 	// — the customer's side of this is the dashboard coming back. Registered in the same commit that