hub v0.71.0: paired recovery mails (F11), prefs seeding at claim + empty-email no-clobber (F12), priority headers + operator test leg (F14-light)

CONTEXT.md

@@ -3,6 +3,24 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-22 — hub v0.71.0: the notification train (audit F11+F12+F14-light).** Four rulings now
+  standing: **(1) recovery pairing** — `*_recovered` notifies the operator always and the customer
+  **iff the customer was mailed the paired stale/down** (evidence = `notification_log` customer-
+  channel sent rows via `store.LastCustomerSentAt`; `enabled_events` deliberately ignored for
+  recovery; ties → no mail). Severity semantics FROZEN — recovery stays `info`, routed by an
+  explicit eventType branch before the severity gate. **(2) seed-at-claim** — `MarkClaimed` seeds
+  `customer_notifications` from the registered email, INSERT-if-absent only (never touches an
+  edited row; empty email = no-op; seed failure never fails the claim); default set is
+  critical-only: node_down, backup_failed, disk_critical, host_disk_critical,
+  storage_fill_critical, offbox_repo_orphaned. **(3) empty-email no-clobber** — a prefs push with
+  empty email preserves a stored address (hub-side belt; controller 0.160.0 already guards its two
+  push legs). **(4) priority headers** — error/critical mails carry `X-Priority: 1` +
+  `Importance: high` (Resend `headers`, live-probed); the `test` event now also mails the operator
+  with those headers (one click proves both channels + rendering). Latent nil-deref fixed:
+  `sendTestEmail` panicked on a customer with no prefs row. NOT yet live: a natural `*_recovered`
+  mail (next real staleness cycle / reboot drill — never fabricate one by blocking reports) and
+  seed-at-claim on a real claim (Peti's Friday reinstall is the natural candidate).
+
 - **2026-07-22 — hub v0.70.1: the ghost customer's Delete button exists now.** The v0.70.0
   ghost-delete path was fully implemented and fully unreachable — the **fourth inert-seam defect**,
   this time a TEMPLATE GATE: the Danger-zone card (and the `customerDeleteOpen` script) sat inside