Day 2026-10-19: agent 0.160.0 (released, not vouched), controller 0.332.0 floor (one sign-in R-1100, escrow confirm R-1151), hub 0.159.0 deployed (R-1150, R-1154), R-1153 not a defect, old-restic check passed; register 168 -> 166 (closed 10, opened R-1155..R-1162)

documentation/architecture/03-host-agent.md

@@ -544,11 +544,18 @@ nicety.
   **loses Felhom's backup guarantees** — no PBS verify / monitoring on storage we can't reach. An
   honest signup-time tradeoff, not a hidden one.
 
-**When the new package reaches the hub (R-978, agent `main` 2026-10-18, unreleased):** a ceremony started again no
+**When the new package reaches the hub (R-978; agent 0.160.0, 2026-10-19):** a ceremony started again no
 longer replaces the hub's package when it starts. The package travels with the pending ceremony and is uploaded when its
 code is claimed, before the code is handed out (an upload failure is a 502 and the code stays claimable). An abandoned
-ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. Residual: the typed-back check
-is the browser's, so a code opened and not written down still replaces the package (R-1151).
+ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. **[DESIGN] Only after the
+household typed it back (R-1151; agent 0.160.0 + controller 0.332.0, 2026-10-19):** a controller ≥ 0.332.0 claims with
+`{"defer_upload": true}`; the agent hands out the code with two word positions it drew, keeps the package (and only those
+two words, never the code) for 30 minutes, and uploads it only when `POST /escrow/ceremony/confirm` brings the two words
+back — so a code opened and not written down never replaces the package. Wrong words 422 (still waiting), window gone 410,
+nothing waiting 404, hub failure 502 (still waiting). A controller that has not updated claims with `{}` and gets the
+R-978 order. Proven on demo-hp 2026-10-19: ceremony 1 typed back → code 1 opens the hub's package, code 0 is a kept
+earlier one (422); ceremony 2 shown and abandoned → code 1 still opens it, code 2 opens nothing
+(`audits/day-2026-10-19/P1/escrow-*.txt`).
 
 #### Custody across generations — what the hub retains when a blob is superseded (hub v0.60.0; **contract corrected hub v0.93.0, R-198**)