Disarm on offboard every sync gate onboard arms, with the same helper, so the two are one operation in both directions

Partnership/partnership_offboard.sh

@@ -17,7 +17,8 @@
 #   Step 1:  Stop rsync         — halt any running sync before state changes
 #   Step 2:  Final sync         — mirror leaves with current Critical-Data state
 #   Step 3:  Reconfigure WebUIs — mirror's auth WebUIs → localhost
-#   Step 4:  Disable sync       — CRITICAL_RSYNC_ENABLED=false in master.conf
+#   Step 4:  Disarm sync gates  — RSYNC/CRITICAL_RSYNC/CONF_SYNC/ARR_SYNC=false in master.conf,
+#                                 the exact inverse of onboard Step 9c
 #   Step 5:  Local cleanup      — remove fallback coverage containers + appdata
 #   Step 6:  Restart own stack  — bring up owner's own parked containers
 #   Step 7:  Remote cleanup     — remove auth/arr stack + fallback containers from mirror
@@ -31,7 +32,7 @@
 #   Step 2: Reconfigure WebUIs  — local auth WebUIs → localhost
 #   Step 3: Remote stack clean  — remove owner-deployed containers locally (auth/arr stack)
 #   Step 4: Fallback cleanup    — remove fallback coverage containers
-#   Step 5: Disable sync        — CRITICAL_RSYNC_ENABLED=false in master.conf
+#   Step 5: Disarm sync gates   — same four gates as the owner path
 #   Step 6: Revoke Emby admin   — remove own admin account from local Emby instance
 #   Step 7: Restart own stack   — bring up own parked containers
 #   Step 8: SSH revocation      — revoke keys both directions, write state, signal owner
@@ -154,6 +155,7 @@ source "$SCRIPTS_ROOT/Plugin/$PLATFORM/Partnership/containers.sh"
 
 # ── Parse flags ───────────────────────────────────────────────────────────────────────────────
 REASON="manual"
+STEP_DISABLE_RSYNC_OK=true   # both paths report it; only the mirror path re-initialised it
 FILTERED_ARGS=()
 
 for arg in "$@"; do
@@ -214,6 +216,39 @@ echo "  Reason:  $REASON"
 echo ""
 [[ "$DRY_RUN" == true ]] && warn "DRY RUN — no permanent changes will be made"
 
+# ==============================================================================================
+# ── HELPER: disarm every sync gate a completed onboard armed ─────────────────────────────────
+#
+# The exact inverse of partnership_onboard.sh Step 9c, which sets RSYNC_ENABLED,
+# CONF_SYNC_ENABLED and ARR_SYNC_ENABLED to true on a completed onboard. Offboard used to turn
+# off CRITICAL_RSYNC_ENABLED and nothing else, which left the far more consequential Tier 1
+# RSYNC_ENABLED switched on with no partner to sync to.
+#
+# That asymmetry read as safe and was not. Turning off one Tier 2 gate looks like "sync is off"
+# in the summary, while INTERMEDIATE, DAILY, WEEKLY and FALLBACK rsync all stayed live behind an
+# open Tier 1 — and CONF_SYNC_ENABLED kept a 4-hourly job reaching for a partner that had just
+# been removed, failing and notifying each time.
+#
+# CRITICAL_RSYNC_ENABLED stays in the list. It is a Tier 2 gate and closing Tier 1 already stops
+# it, but leaving it true would misreport the state to anyone reading the conf rather than the
+# tier logic.
+#
+# FALLBACK_ENABLED is deliberately NOT here. Onboard does not arm it, so offboard has no business
+# disarming it — it is the operator's switch, and the summary says so rather than moving it.
+# ==============================================================================================
+_VV_SYNC_GATES=(RSYNC_ENABLED CRITICAL_RSYNC_ENABLED CONF_SYNC_ENABLED ARR_SYNC_ENABLED)
+
+_disarm_sync_gates() {
+    local gate rc=0 conf="$SCRIPTS_ROOT/Configurations/master.conf"
+    for gate in "${_VV_SYNC_GATES[@]}"; do
+        # set_conf_bool, not update_master_conf: the latter rewrites the whole line and would
+        # strip the trailing comment that explains what each tier gates. Same helper onboard
+        # arms with, so arming and disarming are one operation in two directions.
+        set_conf_bool "$gate" "false" "$conf" || rc=1
+    done
+    return "$rc"
+}
+
 # ==============================================================================================
 # ── HELPER: revoke own admin account from local Emby instance ────────────────────────────────
 #
@@ -335,16 +370,14 @@ if [[ "$AM_MIRROR" == true ]]; then
 
     cleanup_partner_containers || STEP_FALLBACK_CLEANUP_OK=false
 
-    # ── Step 5: Disable critical sync ─────────────────────────────────────────────────────────
+    # ── Step 5: Disarm the sync gates ─────────────────────────────────────────────────────────
     echo ""
-    echo "━━━ $ICON_GEAR Step 5/8 — Disable Critical Sync ━━━"
+    echo "━━━ $ICON_GEAR Step 5/8 — Disarm Sync Gates ━━━"
 
     if [[ "$DRY_RUN" == false ]]; then
-        update_master_conf "CRITICAL_RSYNC_ENABLED" "false" && \
-            warn "CRITICAL_RSYNC_ENABLED=false ✅" || \
-            { warn "Failed to update CRITICAL_RSYNC_ENABLED"; STEP_DISABLE_RSYNC_OK=false; }
+        _disarm_sync_gates || STEP_DISABLE_RSYNC_OK=false
     else
-        warn "DRY RUN — would set CRITICAL_RSYNC_ENABLED=false"
+        warn "DRY RUN — would disarm ${_VV_SYNC_GATES[*]}"
     fi
 
     # ── Step 6: Revoke Emby admin locally ─────────────────────────────────────────────────────
@@ -402,7 +435,7 @@ if [[ "$AM_MIRROR" == true ]]; then
     echo "  Step 2 — WebUIs:           $(_ok "$STEP_WEBUI_OK")"
     echo "  Step 3 — Stack cleanup:    $(_ok "$STEP_STACK_CLEANUP_OK")"
     echo "  Step 4 — Fallback cleanup: $(_ok "$STEP_FALLBACK_CLEANUP_OK")"
-    echo "  Step 5 — Disable sync:     $(_ok "$STEP_DISABLE_RSYNC_OK")"
+    echo "  Step 5 — Sync gates:       $(_ok "$STEP_DISABLE_RSYNC_OK") (${_VV_SYNC_GATES[*]} → false)"
     echo "  Step 6 — Emby revoke:      $(_ok "$STEP_EMBY_OK")"
     echo "  Step 7 — Own stack:        started"
     echo "  Step 8 — Keys revoked:     $(_revoke_status)"
@@ -475,15 +508,14 @@ else
     (( WEBUI_FAILURES++ ))
 fi
 
-# ── Step 4: Disable critical sync ─────────────────────────────────────────────────────────────
+# ── Step 4: Disarm the sync gates ─────────────────────────────────────────────────────────────
 echo ""
-echo "━━━ $ICON_GEAR Step 4/10 — Disable Critical Sync ━━━"
+echo "━━━ $ICON_GEAR Step 4/10 — Disarm Sync Gates ━━━"
 
 if [[ "$DRY_RUN" == false ]]; then
-    update_master_conf "CRITICAL_RSYNC_ENABLED" "false"
-    warn "CRITICAL_RSYNC_ENABLED=false ✅"
+    _disarm_sync_gates || STEP_DISABLE_RSYNC_OK=false
 else
-    warn "DRY RUN — would set CRITICAL_RSYNC_ENABLED=false"
+    warn "DRY RUN — would disarm ${_VV_SYNC_GATES[*]}"
 fi
 
 # ── Step 5: Local container cleanup ───────────────────────────────────────────────────────────
@@ -597,7 +629,7 @@ _revoke_status() {
 echo "  Step 1  — Stop rsync:     $(_ok "$STEP_STOP_OK")"
 echo "  Step 2  — Final sync:     $(_ok "$STEP_SYNC_OK")"
 echo "  Step 3  — WebUI failures: $WEBUI_FAILURES"
-echo "  Step 4  — Disable sync:   ✅"
+echo "  Step 4  — Sync gates:     $(_ok "$STEP_DISABLE_RSYNC_OK") (${_VV_SYNC_GATES[*]} → false)"
 echo "  Step 5  — Local cleanup:  ✅"
 echo "  Step 6  — Own stack:      started"
 echo "  Step 7  — Remote cleanup: $( [[ "$MIRROR_REACHABLE" == true ]] && echo "✅" || echo "skipped (unreachable)" )"
@@ -608,6 +640,10 @@ echo ""
 echo "  Blocklist: $MIRROR blocked — re-onboard to permit access again ✅"
 [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]] && \
     echo "  Tailscale:   $MIRROR removed ✅"
+# Named because it is the one partnership switch neither onboard nor offboard moves, so it
+# survives an offboard still true and there is nothing else that would ever mention it.
+[[ "${FALLBACK_ENABLED:-false}" == true ]] && \
+    echo "  FALLBACK_ENABLED is still true — nothing left to fail over to, turn it off yourself"
 echo ""
 echo "  $MIRROR leaves with:"
 echo "    ✓ Current auth config (final sync)"