Put the media seed behind MEDIA_SEED_ENABLED so a partner filled by other means never starts a multi-week transfer

Tier 2 beside the per-orchestrator gates. Unset reads as on — the toggle postdates the seed.

Rsync/README-Rsync.md

@@ -111,6 +111,11 @@ HOST1's library is ~28 TB against a 12.5 MB/s `--bwlimit`, which is why onboard
 rather than waiting on it, and why the Partnership tab gives it a Stop button — `rsync.sh` runs
 `--inplace --partial`, so stopping costs the file in flight, not the share.
 
+It answers to `MEDIA_SEED_ENABLED` in `master.conf` — a Tier 2 toggle beside the per-orchestrator
+ones, still under Tier 1 `RSYNC_ENABLED`. Off means onboard finishes without ever dispatching it,
+for a partner being filled from a moved disk or one that already holds the library. An unset
+`MEDIA_SEED_ENABLED` reads as on, so a conf that predates the toggle keeps its behaviour.
+
 ---
 
 ## ━━━ HOW THE SCRIPTS RELATE ━━━

Rsync/media_seed.sh

@@ -41,12 +41,19 @@
 #   Interrupting this script costs the current file, not the current share, and a
 #   re-run picks up where it stopped. Stopping it is cheap; that is deliberate.
 #
+# Two Gates, And They Mean Different Things
+#   MEDIA_SEED_ENABLED (master.conf, Tier 2) switches off this transfer and only
+#   this transfer — for a partner being filled from a physically moved disk, or
+#   one that already holds the library. Off is a decision, so it exits 0.
+#   RSYNC_ENABLED (Tier 1) switches off every rsync on the host. Reaching this
+#   script with Tier 1 closed is a misconfiguration, so it exits 1.
+#
 # Gate Read From Disk
-#   RSYNC_ENABLED is read out of master.conf here rather than trusted from the
-#   sourced environment. Onboard's Step 9c rewrites that file moments before
-#   dispatching this script, and each rsync.sh below sources it fresh anyway.
-#   With the gate closed rsync.sh moves nothing and still exits 0, so every share
-#   would be counted as seeded — refuse once instead of reporting fourteen no-ops.
+#   Both are read out of master.conf here rather than trusted from the sourced
+#   environment. Onboard's Step 9c rewrites that file moments before dispatching
+#   this script, and each rsync.sh below sources it fresh anyway. With Tier 1
+#   closed rsync.sh moves nothing and still exits 0, so every share would be
+#   counted as seeded — refuse once instead of reporting fourteen no-ops.
 #
 # One Failed Share Is Not A Failed Seed
 #   A share whose backing disk is unmounted on the partner fails its own rsync and
@@ -58,10 +65,16 @@
 # ==============================================================================================
 #
 #   acquire_lock "skip"   — a second seed cannot run beside the first
-#   Gate check            — refuses when RSYNC_ENABLED is not true
+#   Gate checks           — MEDIA_SEED_ENABLED then RSYNC_ENABLED, in that order
 #   Empty list check      — refuses when DAILY_SYNC_SHARES is empty
 #   Per-share accounting  — failures are listed by name, not summed away
 #
+#   An absent MEDIA_SEED_ENABLED reads as on, never as off.
+#       The toggle was added after this script shipped, so a master.conf that has not been
+#       through a conf_upgrade does not have the key. Defaulting an unset toggle to off would
+#       silently stop seeding on every node that has not upgraded — a change in behaviour
+#       delivered by a missing line, which is the hardest kind to notice.
+#
 # ==============================================================================================
 # RUNTIME MODES
 # ==============================================================================================
@@ -94,11 +107,24 @@ echo "━━━ $ICON_SYNC Media Share Seed — $MY_ID ($LOCAL_SERVER_NAME) —
 echo ""
 
 # See "Gate Read From Disk" above. The trailing comment is cut before the value is compared:
-# master.conf writes this as `RSYNC_ENABLED=true    # Tier 1 — global gate, overrides everything
+# master.conf writes these as `RSYNC_ENABLED=true    # Tier 1 — global gate, overrides everything
 # below`, so stopping at `cut -d= -f2` yields "true#Tier1—globalgate,…" and never matches.
-_gate=$(grep -m1 -E '^[[:space:]]*RSYNC_ENABLED=' "$SCRIPTS_ROOT/Configurations/master.conf" 2>/dev/null \
-        | cut -d= -f2- | cut -d'#' -f1 | tr -d '"'"'" | tr -d '[:space:]')
+_read_gate() {
+    grep -m1 -E "^[[:space:]]*$1=" "$SCRIPTS_ROOT/Configurations/master.conf" 2>/dev/null \
+        | cut -d= -f2- | cut -d'#' -f1 | tr -d '"'"'" | tr -d '[:space:]'
+}
 
+# Tier 2 first, because it is the more specific answer and the operator deserves to be told
+# which switch stopped this. An unset MEDIA_SEED_ENABLED is treated as on: it was added after
+# the seed already existed, so a conf that predates it must keep behaving the way it did.
+_seed_gate=$(_read_gate MEDIA_SEED_ENABLED)
+if [[ "$DRY_RUN" == false && -n "$_seed_gate" && "$_seed_gate" != "true" ]]; then
+    warn "MEDIA_SEED_ENABLED is '$_seed_gate' — the media seed is switched off in master.conf"
+    warn "Set it true there if the partner should be filled by rsync rather than by hand"
+    exit 0
+fi
+
+_gate=$(_read_gate RSYNC_ENABLED)
 if [[ "$DRY_RUN" == false && "$_gate" != "true" ]]; then
     error "RSYNC_ENABLED is '${_gate:-unset}' — rsync.sh would move nothing"
     error "Arm it in master.conf, then re-run this script"