R-302: the abandon banner promises only what the box can still see is true

The retrieval clause rendered unconditionally on every page and is false on a
reachable state - the same screen where the orphan card says we cannot tell.

The condition is a fingerprint PINNED at the decision, not a comparison against
the current key. The obvious proxy asks about the wrong key: the set-aside
copies were written under an older key the box no longer has, so on a
twice-rebuilt box the proxy promises about copies nothing can open. Demonstrated
- under the proxy, the replaced-package and legacy cases both flip back to
promising.

The pin is a recorded assumption and says so: nothing on the box records which
key wrote those copies. Empty is not a match. A countdown started before this
carries no pin and takes the cautious branch, not a backfill.

A sweep of all 36 templates found a fourth instance (backups page, same
condition applied) and a fifth (the confirmation screen, correctly left alone -
true at the moment of the decision).

New retrieval_promise_gate registers each claim with a reason rather than
banning a verb: a string ban failed twice, and the honest replacement copy
contains the stem.

controller/internal/web/handlers.go

@@ -953,6 +953,11 @@ func (s *Server) backupsRemoteHandler(w http.ResponseWriter, r *http.Request) {
 			data["AbandonActive"] = true
 			data["AbandonDaysLeft"] = st.DaysLeft
 			data["AbandonDate"] = st.DueAt.Format("2006-01-02")
+			// R-302: this block makes the SAME retrieval promise as the banner, under a different verb
+			// („visszaszerezhetők" vs the banner's „visszaszerezheted"), which is why it was a fourth
+			// instance nobody had counted. Same single derivation — fixing one surface and not the other
+			// would leave the page contradicting the strip above it.
+			data["AbandonRetrievalOffered"] = st.RetrievalStillOffered
 		} else if st.PurgeRequested {
 			// The store is deleted and the sealed package is on its way out. Say so rather than
 			// showing nothing, or the page silently loses a thing the customer was watching.