Push INACTIVE to the mirror before revoking the key that push needs, and stop two steps reporting success they did not have

Partnership/partnership_manager.sh

@@ -902,8 +902,15 @@ check_both_healthy() {
     return 0
 }
 
+# Returns non-zero when the mirror did NOT leave with current state, so the caller can say so.
+# The whole point of this step is the guarantee in the summary — "mirror leaves with current
+# Critical-Data" — and it used to print that unconditionally at the end of the function. An
+# offboard with RSYNC_ENABLED=false logged "rsync globally disabled, skipping all syncs"
+# immediately followed by "Final sync complete — mirror has current state ✅", and the summary
+# scored Step 2 as a pass. The mirror left with whatever it happened to have.
 do_final_sync() {
     log "Running final critical sync..."
+    local _synced=0 _failed=0
     if [[ "$DRY_RUN" == false ]]; then
         if [[ "${#CRITICAL_SYNC_SHARES[@]}" -gt 0 ]]; then
             for _share in "${CRITICAL_SYNC_SHARES[@]}"; do
@@ -916,17 +923,30 @@ do_final_sync() {
                     bash "$SCRIPT_DIR/../Rsync/rsync.sh" "$_path" \
                         --profile="$_profile" --log
                 fi
+                # rsync.sh exits 0 both on a real sync and on a clean Tier-1 gate exit, so the
+                # gate is checked here rather than inferred from its status.
+                if [[ "${RSYNC_ENABLED:-true}" == true ]]; then (( _synced++ )); else (( _failed++ )); fi
             done
         else
             warn "CRITICAL_SYNC_SHARES is empty — skipping final sync (configure in host*.conf)"
+            _failed=1
         fi
     else
         # ${#ARR[@]} and :- cannot be combined — bash rejects the whole word as "bad substitution",
         # so this line aborted Step 2 of every offboard --dry-run with a shell error instead of
         # printing. A count of an unset array is already 0, which is the only default needed.
         warn "DRY RUN — would run final critical sync (${#CRITICAL_SYNC_SHARES[@]} shares)"
+        return 0
+    fi
+
+    if [[ "$_failed" -gt 0 ]]; then
+        warn "Final sync did NOT complete — $MIRROR leaves with whatever state it already had"
+        [[ "${RSYNC_ENABLED:-true}" != true ]] && \
+            warn "  RSYNC_ENABLED=false — the Tier 1 gate stopped it before any share was sent"
+        return 1
     fi
     warn "Final sync complete — mirror has current state ✅"
+    return 0
 }
 
 # Safe master.conf modification with error handling — appends the key if not already present,