Create the network and cache partner confs in phase 1, where SSH already works and no plugin is needed on the far side

Partnership/partnership_onboard.sh

@@ -168,7 +168,8 @@
 #     shares are not populated yet.
 #
 # Partnership/partnership_onboard.sh --phase1-only
-#     OWNER only: SSH key exchange + conf push. Safe to run before HOST2 has Varaverk.
+#     OWNER only: SSH key exchange, conf push, docker network, partner conf cache.
+#     Safe to run before HOST2 has Varaverk — all of it needs docker and SSH, not the plugin.
 #     Writes HOST2_PHASE1_DONE=true to varaverk_setup.db.
 #
 # Partnership/partnership_onboard.sh --phase2-only
@@ -473,6 +474,8 @@ echo ""
 
 STEP_SSH_OK=false
 STEP_NETWORK_OK=false
+PHASE1_NET_OK=false      # Phase 1 only — network created on the mirror before any deploy
+PHASE1_CACHE_OK=false    # Phase 1 only — our conf pushed into the mirror's RAM cache
 STEP_STOP_AUTH_OK=true
 STEP_AUTH_OK=true
 AUTH_DEPLOYED=0
@@ -595,6 +598,65 @@ if [[ "$PHASE1_ONLY" == true ]]; then
         fi
     fi
 
+    # ── Phase 1 — Docker network on the mirror ────────────────────────────────────────────────
+    # Here, not only in Step 1b, because a --phase1-only run exits above and never reaches it.
+    # The mirror needs docker, not Varaverk, so this works before the plugin is installed — and
+    # creating the network now means it is in place long before the first container is deployed
+    # against it. Deploying against a missing network is what left twelve containers stuck in
+    # `Created`, so the earliest safe moment is the right one.
+    echo ""
+    echo "━━━ Phase 1 — Docker Network ($MIRROR) ━━━"
+    if [[ "$DRY_RUN" == true ]]; then
+        warn "DRY RUN — would create any networks the stack templates reference on $MIRROR"
+        PHASE1_NET_OK=true
+    elif ensure_stack_networks_on_remote "$MIRROR_IP" "$MIRROR_SSH_KEY"; then
+        PHASE1_NET_OK=true
+    else
+        warn "Network prep incomplete on $MIRROR — Step 1b retries this during Phase 2"
+    fi
+
+    # ── Phase 1 — Partner conf cache ──────────────────────────────────────────────────────────
+    # CONF_SYNC_ENABLED is armed here rather than waiting for Step 9c. It is the safe one of the
+    # three gates — it moves no data, it copies each side's host*.conf into the other's tmpfs so
+    # partner vars resolve — and the moment SSH works is the moment that should start. Leaving it
+    # until Phase 2 meant conf_sync.sh, which sources the conf fresh in its own process, exited
+    # on a closed gate every time it was called before then.
+    #
+    # Push always; pull only if the mirror actually has a conf yet. Before HOST2 installs Varaverk
+    # there is nothing to pull, and an unconditional pull would count a failure and notify about
+    # a condition that is simply "HOST2 is not installed". The pull lands on the re-run after the
+    # install — the same --phase1-only --skip-ssh the operator uses to push conf again.
+    echo ""
+    echo "━━━ Phase 1 — Partner Conf Cache ━━━"
+    _conf_sync_script="$SCRIPTS_ROOT/System_Essentials/conf_sync.sh"
+    if [[ "$DRY_RUN" == true ]]; then
+        warn "DRY RUN — would arm CONF_SYNC_ENABLED and cache confs with $MIRROR"
+        PHASE1_CACHE_OK=true
+    elif [[ ! -f "$_conf_sync_script" ]]; then
+        warn "conf_sync.sh not found — skipping partner conf cache"
+    else
+        _arm_conf_var CONF_SYNC_ENABLED "true" "$SCRIPTS_ROOT/Configurations/master.conf" \
+            || warn "Could not arm CONF_SYNC_ENABLED — cache step may no-op"
+
+        if bash "$_conf_sync_script" --push-only; then
+            PHASE1_CACHE_OK=true
+        else
+            warn "Could not push our conf to $MIRROR"
+        fi
+
+        _mirror_sd=$(resolve_remote_scripts_dir "$MIRROR_IP" "$MIRROR_SSH_KEY" "no")
+        if timeout "$SSH_TIMEOUT" ssh -i "$MIRROR_SSH_KEY" \
+             -o ConnectTimeout="$SSH_TIMEOUT" -o BatchMode=yes -o StrictHostKeyChecking=no \
+             root@"$MIRROR_IP" \
+             "[ -f '${_mirror_sd}/Configurations/${MIRROR_ID,,}.conf' ]" 2>/dev/null; then
+            bash "$_conf_sync_script" --pull-only || warn "Could not pull ${MIRROR_ID,,}.conf from $MIRROR"
+        else
+            echo "  $MIRROR has no ${MIRROR_ID,,}.conf yet — it will cache once Varaverk is installed there"
+        fi
+        unset _mirror_sd
+    fi
+    unset _conf_sync_script
+
     # HOST1 local setup — runs immediately without needing HOST2
     echo ""
     echo "━━━ Phase 1 — HOST1 Local Setup ━━━"
@@ -608,6 +670,8 @@ if [[ "$PHASE1_ONLY" == true ]]; then
     echo "━━━━━ $ICON_SUMMARY PHASE 1 COMPLETE ━━━━━"
     echo "  SSH keys:     $( [[ "$STEP_SSH_OK" == true ]] && echo "ready ✅" || echo "skipped" )"
     echo "  Conf push:    $( [[ "$CONF_PUSH_OK" == true ]] && echo "done ✅" || echo "⚠ manual needed" )"
+    echo "  Network:      $( [[ "$PHASE1_NET_OK" == true ]] && echo "ready on $MIRROR ✅" || echo "⚠ Step 1b will retry" )"
+    echo "  Conf cache:   $( [[ "$PHASE1_CACHE_OK" == true ]] && echo "pushed to $MIRROR ✅" || echo "⚠ not cached" )"
     echo "  HOST1 setup:  done ✅"
     echo "  Duration:     $(format_duration $(( END - START )))"
     echo ""