v0.203.0: the box collects what the hub staged for it (R-218 consume half) + R-220's message

R-218's declaration half shipped in v0.201.0 and works. Its consume half never
existed. Reconcile ran exactly twice per process — at start-up and when the
recovery screen drives it — and BOTH fire before the hub has anything staged,
because the hub stages in RESPONSE to the declaration those runs precede.

Measured on the R-201 re-walk: unlock reconcile 11:43:07, hub staged 11:44:57
saying 'next cycle', a full report cycle ran 11:55:46, still unconsumed at
12:06. A guest command line applied it in 18 seconds — everything correct except
the trigger.

Bridge.RetryIfDeclared re-runs the SAME reconcile on a 5-minute tick, driven from
the box's own published declaration (OffboxReportStatus().State) — the very
statement the hub acts on, so the two cannot disagree.

Poll, not an ACK flag, decided on the promise: the no-target message says 'amint
megvannak' (no deadline) and the card says 'within a day'. Five minutes is inside
both by a wide margin and needs no hub change.

It stops by construction — a healthy box does no work and logs nothing — and the
settle gate is deliberately kept via ReconcileWhenSettled.

The marker was investigated and left alone: applied_marker lives in the guest's
DataDir, which a rebuild destroys, so it cannot suppress a legitimate re-run.

R-220's customer half: the refusal no longer tells the customer to choose from a
list that may be empty. It names the rebuild, points at the Meghajtók page, and
promises no outcome.

Red-proofs: remove the retry -> credential uncollected (the dead end reproduced);
drop the stop condition -> a healthy box hammers the hub; call Reconcile instead
of ReconcileWhenSettled -> settle gate bypassed; restore the old sentence -> the
impossible action returns.

28 packages ok, vet clean, all controller gates OK.

controller/internal/settings/settings.go

@@ -1580,8 +1580,23 @@ func (s *Settings) RefuseAsAppNamespace(path string) (bool, string) {
 const (
 	refuseAppNamespaceNetwork = "Hálózati tárhelyen (NAS) nem futtatható alkalmazás adatkönyvtára — " +
 		"a NAS megosztás tallózásra és médiatárolásra használható. Válasszon csatlakoztatott meghajtót."
+	// ⚠ R-220 / SCENARIO G — THIS SENTENCE USED TO NAME AN IMPOSSIBLE ACTION.
+	//
+	// It said *"Válasszon a listából csatlakoztatott meghajtót"* — choose an attached drive from the
+	// list — and on a rebuilt box that list is EMPTY, for a reason the customer had no part in and no
+	// way to see. Measured three times live (CAMPAIGN-11 Phase 1, and twice on the R-201 re-walk).
+	// Telling someone to pick from an empty list is the I3 breach the campaign recorded: a refusal must
+	// name a reason a person can act on.
+	//
+	// It now says what is true — the drive is not registered ON THIS MACHINE, which is what a rebuild
+	// causes — and points at the page where re-attaching happens, rather than at a list that may hold
+	// nothing. It promises no outcome, because whether the drive can be re-attached is not knowable
+	// from here.
 	refuseAppNamespaceUndeterminable = "A megadott tárhely nem azonosítható regisztrált meghajtóként, " +
-		"ezért alkalmazás adatkönyvtáraként nem használható. Válasszon a listából csatlakoztatott meghajtót."
+		"ezért alkalmazás adatkönyvtáraként nem használható. Ha a gépet nemrég telepítettük újra, a " +
+		"meghajtóid megvannak, de még nincsenek újra csatlakoztatva ehhez a géphez — a Tárhely → " +
+		"Meghajtók oldalon csatlakoztathatod őket, és utána indítsd újra a telepítést. Ha ott sem " +
+		"látszanak, keresd a Felhom ügyfélszolgálatát."
 )
 
 // IsStoragePathSchedulable returns whether a path belongs to a registered,