Make seeding Phase 3 — its own operator-triggered phase, not the tail of an onboard

Onboard now ends at Phase 2: connected, running, and saying so. Phase 3 sets the seeding gate posture and dispatches the seed. With MEDIA_SEED_ENABLED false there is no Phase 3 and the model is two phases.

Rsync/media_seed.sh

@@ -174,5 +174,22 @@ if [[ "$SEEDED" -eq 0 ]]; then
     error "No shares seeded"
     exit 1
 fi
-[[ "${#FAILED_SHARES[@]}" -gt 0 ]] && exit 1
+if [[ "${#FAILED_SHARES[@]}" -gt 0 ]]; then
+    warn "Phase 3 incomplete — the flag stays unset while any share is unseeded"
+    exit 1
+fi
+
+# Phase 3 is complete only when every share landed. This is what the Partnership tab reads to
+# stop offering ▶ Phase 3, so writing it on a partial run would retire the button over a partner
+# still missing shares — and a partial seed is the normal outcome of the first attempt, because
+# a disk unmounted on the far side fails its share and no other.
+#
+# Written here rather than by the dispatcher: the dispatcher returns in seconds and knows only
+# that the job started. Weeks separate those two facts.
+if [[ -n "${REMOTE_ID:-}" ]]; then
+    set_state_var "$(platform_setup_db_path)" "${REMOTE_ID}_PHASE3_DONE" "true"
+    platform_push_setup_state >/dev/null 2>&1 \
+        || warn "Phase 3 flag written locally but not pushed to the partner"
+    echo "Phase 3 complete — ${REMOTE_ID}_PHASE3_DONE=true ✅"
+fi
 exit 0