R-241 part 3: abandoning starts a 14-day countdown that ends the question

Until now "set aside" renamed the remote store and touched neither the escrow
nor the key, so the hub went on holding a sealed package for a key the box no
longer used. Shape (c) compares those two, finds them different, and offers
recovery - correctly, and for ever. A customer who had already said "I do not
want the old data" would be asked again at every login.

The operator's ruling is that the answer is NOT a "they decided" flag: fix the
state, do not remember that it is wrong. So the decision starts a countdown,
at the end of which the set-aside store and the sealed package that protects
it are removed TOGETHER. Afterwards shape (c) has nothing to compare and the
offer falls silent on its own - because the state is right, not because
something remembers it once was not.

THE GRACE IS REAL. The recovery offer stays reachable for the whole 14 days;
that is the change-of-mind path, and a grace in which recovery is impossible
would be decorative.

BOTH HALVES OR NEITHER. Removing only the store leaves a package that opens
nothing; removing only the package leaves ciphertext nobody can ever decrypt.
The two cannot be atomic across two machines, so it is a two-phase commit:
delete the store, record a durable marker, and keep DECLARING
offsite.abandon_purge_requested until the hub's ACK stops reporting a
superseded package. A crash between the halves re-declares on the next sweep;
it never leaves the pair half-removed and silent.

HUB HALF - SEC 8.2 ANSWERED: yes, the hub was needed, and only for this.
store.PurgeSupersededEscrowForCustomer is the one place R-198's retention is
ever undone, and it never touches host_escrow (the package covering the key
the box uses now). The handler acts on the DECLARATION, never an inference,
and is placed immediately BEFORE the ACK is built - so
GetEscrowStatusForCustomer reads the effect and the SAME response closes the
box's two-phase commit. No second round-trip and no window where the box
thinks it is still owed. felhom-agent was NOT touched.

The countdown starts in ResetOrphanedRepo, NOT in the shared helper: the
helper is also the unclaimed auto-reset path, where nobody decided anything,
and an as-delivered box tidying a stranger's leftover store must not get a
customer's deletion clock. Pinned by a test.

Cancellation is wired into the recovery unlock, BEFORE the tier-up and the
listing - those can fail, and a countdown surviving a successful unlock
because a later step errored would delete the history the customer just
proved they can open.

The sweep is a Daily job at 05:10, not on the backup leg: it must run on a box
whose tier is not configured for runs. Quiet by construction on every box with
no countdown, and that silence is asserted.

Tests (all clock-injected; SEC 7.4 forbids shortening a live timer):
Scenario E (aside + package kept + countdown + offer still reachable, and
NOTHING deleted), Scenario F (both halves, the declaration repeating, the
close-out), Scenario G (cancel, path still nameable, no later deletion),
plus: not closed out while the package remains, a transport failure leaves the
countdown due and retrying, the no-op sweep issues zero remote commands, and
the unclaimed auto-reset starts no countdown.

RED-PROOFS, each with the mutation confirmed present in the file first:
  F1) store deletion skipped -> Scenario F FAILS (no rm issued)
  F2) declaration dropped from the report -> Scenario F FAILS (the hub is
      never asked; the package would outlive the store for ever)
  G)  CancelAbandon made a no-op -> Scenario G FAILS (uncancellable countdown)

Green: controller and hub both build, vet and test clean; controller gates OK.
NOTHING WAS DELETED ANYWHERE - the terminal step has only ever run against
in-test fakes.

controller/internal/backup/offbox.go

@@ -344,7 +344,21 @@ func (m *Manager) ResetOrphanedRepo(ctx context.Context) error {
 	}
 	t := m.settings.GetOffboxTarget()
 	base, env := m.offboxBaseArgs(t)
-	return m.resetOrphanedRepo(ctx, base, env, "operator-confirmed (claimed)")
+	if err := m.resetOrphanedRepo(ctx, base, env, "operator-confirmed (claimed)"); err != nil {
+		return err
+	}
+	// R-241: THE COUNTDOWN STARTS HERE AND NOT IN THE SHARED HELPER, deliberately. The helper is also
+	// the UNCLAIMED auto-reset path (Scenario B in ensureOffboxRepo), where nobody decided anything —
+	// an as-delivered box tidying a stranger's leftover store must not put a customer's 14-day
+	// deletion clock on it. Only the confirmed, claimed choice is a decision.
+	//
+	// The path is read back from OrphanedRenamedTo, which the helper has just written.
+	if cur := m.settings.GetOffboxTarget(); cur != nil && cur.OrphanedRenamedTo != "" {
+		m.startAbandonCountdown(cur.OrphanedRenamedTo)
+	} else {
+		m.logger.Printf("[WARN] [offbox] the reset succeeded but no set-aside path was recorded — no countdown started; the old history stays indefinitely")
+	}
+	return nil
 }
 
 // shellQuote single-quotes a path for the remote shell (our repo paths have no single quotes).
@@ -1406,6 +1420,15 @@ type OffboxReportStatus struct {
 	// rebuilt-and-stranded — and the hub cannot tell them apart. The BOX can, from two local facts it
 	// holds with certainty. So it says so.
 	State string `json:"state,omitempty"`
+	// AbandonPurgeRequested (v0.206.0, R-241) — the customer's abandonment countdown has run out, the
+	// set-aside off-site history HAS been deleted, and the hub is asked to drop the sealed package
+	// that protected it so the two halves go together (Scenario F).
+	//
+	// It is a DECLARATION, on the same principle as State: the box knows it has deleted the store; the
+	// hub cannot see that and must not infer it. It keeps being sent until the ACK stops reporting a
+	// superseded package, so a lost request retries by itself rather than leaving the pair half-gone.
+	// Absent/false on every other box, so a healthy report is byte-identical to v0.205.0's.
+	AbandonPurgeRequested bool `json:"abandon_purge_requested,omitempty"`
 	LastRun     string `json:"last_run,omitempty"`    // RFC3339
 	LastStatus  string `json:"last_status,omitempty"` // "ok" | "incomplete" (R-203) | "error" | "running"
 	// LastSuccess (R-100) is the last run that SUCCEEDED — the hub's staleness anchor. Absent on a
@@ -1605,6 +1628,7 @@ func (m *Manager) OffboxReportStatus() *OffboxReportStatus {
 		Enabled: true, EscrowState: t.EscrowState, LastRun: t.LastRun, LastStatus: t.LastStatus,
 		LastSuccess:   t.LastSuccess,
 		SnapshotCount: t.SnapshotCount, RepoSizeBytes: t.RepoSizeBytes, QuotaGB: t.QuotaGB,
+		AbandonPurgeRequested: t.AbandonPurgeRequested, // R-241: declared until the hub drops the package
 	}
 }