docs for v0.206.0: CHANGELOG, CONTEXT, REUSE, README

CHANGELOG v0.206.0 with the ruling that reversed the fix, the three changes,
the SEC 7.2 staleness decision, Q7's closed trap, and the two bugs the tests
caught rather than review.

CONTEXT carries the three rules this session established, in the form the next
session needs them:
  - a box does not create a repository key while the hub holds a sealed
    package for it;
  - the fact that answers a question must be kept where the question is asked;
  - fix the state, do not remember that it is wrong.

REUSE gains four rows, each carrying the trap rather than just the signature:
the mint guard is a CONJUNCTION and t.Enabled is load-bearing in the derived
predicate; the discriminator ships INERT unless wired in main.go's confirmer
literal; the countdown removes BOTH halves or neither and must be driven by an
injected clock; and the epoch must be synced FIRST and unconditionally or the
falling edge is lost.

README documents the three customer-visible changes and the operator levers.

No version literal was edited: the controller version is ldflags-only.

CONTEXT.md

@@ -7,7 +7,42 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-08-06 (v0.205.0 — R-234: a run that skipped a selected app is not successful)
+Last updated: 2026-08-07 (v0.206.0 — R-241: the box does not mint a key over a sealed package)
+
+> **2026-08-07 — v0.206.0 (R-241). THE RULING, and it reversed the fix: this was a MINTING defect,
+> not a screen-predicate defect.** The recovery screen was telling the truth — there genuinely was
+> nothing recoverable under the key the box held, because **the box minted that key itself over the
+> top of a sealed package it already knew the hub was holding**. Fixing the predicate would have
+> papered over a machine quietly making its own backups unopenable.
+>
+> **THE RULE: a box does not create a repository key while the hub holds a sealed package for it.**
+> The guard is a conjunction (package held AND no key), so a first-time box is untouched, and the
+> refusal is a HOLDING state rather than a failure — the transport is still configured so the
+> recovery screen can bring the tier up the moment the key arrives.
+>
+> **THE SECOND RULE: the fact that answers a question must be kept where the question is asked.** The
+> hub-vs-local key comparison had been computed on every ACK since SLICE 3 and persisted nowhere; on
+> the venue it logged the right answer thirty-five minutes before the customer looked at a screen
+> that could not see it. It is now persisted and drives shape (c) of the offer.
+>
+> **THE THIRD RULE (the operator's, and it generalises): fix the state, do not remember that it is
+> wrong.** Abandoning the old history now starts a 14-day countdown that removes the set-aside store
+> and its sealed package TOGETHER, after which the offer falls silent on its own because there is
+> nothing left to compare — rather than a "they decided" flag suppressing a screen over a state that
+> is still wrong. The recovery offer stays reachable for the whole grace; a grace in which recovery
+> is impossible is decorative.
+>
+> **Surface:** the full page appears once per ENTRY into the offered state, not once ever — a box
+> rebuilt months later is a new situation. Three dismissal levers with three scopes, and none of them
+> removes the entry point on the backups page.
+>
+> **Needs hub v0.98.0** for the superseded-package purge. `felhom-agent` untouched.
+>
+> **Two real bugs were caught by tests rather than by review** — a missing `t.Enabled` (an existing
+> test) and a missing falling-edge sync that reintroduced the very defect the epoch exists to fix.
+>
+> **NOT built, deliberately:** the automatic 30-day abandonment (R-245, with the operator's reasoning
+> recorded), and R-242's release-to-golden gate.
 
 > **2026-08-06 — v0.205.0 (R-234).** THE RULE: **a run that skipped an app the customer selected is
 > not a successful run.** The R-203 verdict block already said *"a warning beside a success is read