v0.203.0: the box collects what the hub staged for it (R-218 consume half) + R-220's message

R-218's declaration half shipped in v0.201.0 and works. Its consume half never
existed. Reconcile ran exactly twice per process — at start-up and when the
recovery screen drives it — and BOTH fire before the hub has anything staged,
because the hub stages in RESPONSE to the declaration those runs precede.

Measured on the R-201 re-walk: unlock reconcile 11:43:07, hub staged 11:44:57
saying 'next cycle', a full report cycle ran 11:55:46, still unconsumed at
12:06. A guest command line applied it in 18 seconds — everything correct except
the trigger.

Bridge.RetryIfDeclared re-runs the SAME reconcile on a 5-minute tick, driven from
the box's own published declaration (OffboxReportStatus().State) — the very
statement the hub acts on, so the two cannot disagree.

Poll, not an ACK flag, decided on the promise: the no-target message says 'amint
megvannak' (no deadline) and the card says 'within a day'. Five minutes is inside
both by a wide margin and needs no hub change.

It stops by construction — a healthy box does no work and logs nothing — and the
settle gate is deliberately kept via ReconcileWhenSettled.

The marker was investigated and left alone: applied_marker lives in the guest's
DataDir, which a rebuild destroys, so it cannot suppress a legitimate re-run.

R-220's customer half: the refusal no longer tells the customer to choose from a
list that may be empty. It names the rebuild, points at the Meghajtók page, and
promises no outcome.

Red-proofs: remove the retry -> credential uncollected (the dead end reproduced);
drop the stop condition -> a healthy box hammers the hub; call Reconcile instead
of ReconcileWhenSettled -> settle gate bypassed; restore the old sentence -> the
impossible action returns.

28 packages ok, vet clean, all controller gates OK.

controller/internal/offsiteapply/offsiteapply.go

@@ -341,3 +341,36 @@ func (b *Bridge) ReconcileWhenSettled(gateCtx context.Context) error {
 	defer cancel()
 	return b.Reconcile(ctx)
 }
+
+// ── R-218, THE CONSUME HALF ──────────────────────────────────────────────────────────────────────
+//
+// `Reconcile` was correct from the day it shipped and was simply never run again. It fires at
+// start-up and once more when the recovery screen drives it (R-219) — and BOTH precede the moment the
+// hub has anything staged, because the hub stages in RESPONSE to the declaration those runs come
+// before. So the hub held a credential the box would never fetch.
+//
+// Measured on the R-201 re-walk, 2026-08-06: unlock reconcile 11:43:07 · hub staged 11:44:57 saying
+// "the box re-consumes on its next cycle" · a full report cycle ran 11:55:46 · still unconsumed at
+// 12:06. A guest command line moved it in 18 seconds — everything was fine except the trigger.
+
+// NeedsCredentialFunc reports whether the box STILL declares it needs a transport credential. It is
+// deliberately the box's own published declaration (`backup.OffboxReportStatus().State`) rather than a
+// second predicate: the hub acts on that statement, so driving the retry from anything else would let
+// the two disagree about whether a retry is wanted.
+type NeedsCredentialFunc func() bool
+
+// RetryIfDeclared is ONE tick of the consume half.
+//
+// It reconciles **only while the box declares a need**, which is what makes it stop: the instant a
+// target exists the declaration goes false, this returns immediately, and a healthy box does no work
+// and logs nothing. The settle gate is deliberately preserved — `ReconcileWhenSettled` waits for floor
+// knowledge exactly as the start-up path does, because the day-0 race it guards is unchanged.
+//
+// Returns whether a reconcile was ATTEMPTED, so a caller (and a test) can tell "declined to run" from
+// "ran and failed" without reading the log.
+func (b *Bridge) RetryIfDeclared(ctx context.Context, declared NeedsCredentialFunc) (attempted bool, err error) {
+	if b == nil || declared == nil || !declared() {
+		return false, nil
+	}
+	return true, b.ReconcileWhenSettled(ctx)
+}

controller/internal/offsiteapply/retry_test.go

@@ -0,0 +1,101 @@
+package offsiteapply
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+// ── R-218's CONSUME HALF ─────────────────────────────────────────────────────────────────────────
+//
+// Measured on the R-201 re-walk, 2026-08-06: the hub staged a credential at 11:44:57 and logged
+// "the box re-consumes on its next cycle"; a full report cycle ran at 11:55:46; at 12:06 it was still
+// unconsumed, and a guest command line applied it in 18 seconds. Everything was correct except that
+// nothing ever re-ran the reconcile.
+//
+// These assert the EFFECT — was a reconcile attempted, and did the tier get applied — not that a
+// helper returned a bool.
+
+// ── SCENARIO A — a credential staged AFTER start-up is collected, unaided ────────────────────────
+//
+// RED-PROOF: make RetryIfDeclared return (false, nil) unconditionally — i.e. remove the retry, which
+// is the pre-v0.203.0 world — and this FAILS with the credential still sitting unconsumed. That is
+// the re-walk's first dead end, reproduced.
+func TestRetryIfDeclared_CollectsACredentialStagedAfterStartup(t *testing.T) {
+	b, cons, _, en, _ := newBridge(t, goodOffsite())
+
+	// The box declares: it was rebuilt, has no target, and the hub holds a package for it.
+	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return true })
+	if err != nil {
+		t.Fatalf("retry: %v", err)
+	}
+	if !attempted {
+		t.Fatal("R-218 RETURNED: the box declared a need and no reconcile was attempted")
+	}
+	// EFFECT: the one-time password was actually consumed and the tier configured.
+	if cons.calls == 0 {
+		t.Fatal("the staged credential was never collected")
+	}
+	if en.calls == 0 {
+		t.Fatal("the off-site tier was never configured after collecting the credential")
+	}
+}
+
+// ── SCENARIO C — a healthy box does not retry, and makes no noise ────────────────────────────────
+//
+// RED-PROOF: drop the `!declared()` guard so the tick always reconciles → this FAILS, and a box whose
+// tier already works hammers the hub forever.
+func TestRetryIfDeclared_HealthyBoxDoesNothing(t *testing.T) {
+	b, cons, inst, en, logbuf := newBridge(t, goodOffsite())
+
+	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return false })
+	if err != nil {
+		t.Fatalf("retry: %v", err)
+	}
+	if attempted {
+		t.Fatal("a box that declares NO need must not reconcile")
+	}
+	if cons.calls != 0 || inst.calls != 0 || en.calls != 0 {
+		t.Fatalf("a healthy box touched the hub: consume=%d install=%d enable=%d", cons.calls, inst.calls, en.calls)
+	}
+	if strings.TrimSpace(logbuf.String()) != "" {
+		t.Fatalf("a healthy box logged noise every tick: %q", logbuf.String())
+	}
+}
+
+// A nil bridge (off-site not configured for this customer) is a silent no-op, not a panic — main.go
+// wires nil in exactly that case.
+func TestRetryIfDeclared_NilBridgeIsSilent(t *testing.T) {
+	var b *Bridge
+	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return true })
+	if attempted || err != nil {
+		t.Fatalf("a nil bridge must be a silent no-op, got attempted=%v err=%v", attempted, err)
+	}
+}
+
+// ── SCENARIO D — the settle gate still holds on the retry path ───────────────────────────────────
+//
+// The retry must not become a back door around the day-0 floor race the gate exists for. It goes
+// through ReconcileWhenSettled, so an unsettled box WAITS rather than reconciling immediately.
+//
+// RED-PROOF: change RetryIfDeclared to call Reconcile directly instead of ReconcileWhenSettled →
+// this FAILS, because the reconcile happens while the floor is still unknown.
+func TestRetryIfDeclared_HonoursTheSettleGate(t *testing.T) {
+	b, cons, _, _, _ := newBridge(t, goodOffsite())
+	// Floor never becomes known → the gate must hold the reconcile off until its own bound expires.
+	b.Settle = SettleFunc(func() (string, string, bool, bool) { return "0.203.0", "", false, false })
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // the gate observes a cancelled context and must not proceed to reconcile
+
+	attempted, err := b.RetryIfDeclared(ctx, func() bool { return true })
+	if !attempted {
+		t.Fatal("the box declared, so a retry attempt must be reported even when the gate stops it")
+	}
+	if err == nil {
+		t.Fatal("a cancelled gate must surface an error, not silently reconcile")
+	}
+	if cons.calls != 0 {
+		t.Fatal("SETTLE GATE BYPASSED: the retry consumed a password while the floor was unknown")
+	}
+}