Ship a freshly seeded node inert, so it cannot sync before anyone has looked at it

Deployment/master.conf.template

@@ -197,13 +197,20 @@
 # ── Conf Sync ──
 # conf_sync.sh pulls partner host confs into /tmp/.vv/ RAM cache on array start and after
 # any conf save — makes partner vars (HOST2_*, etc.) available without touching git.
-    CONF_SYNC_ENABLED=true
+# Ships OFF for the same reason as RSYNC_ENABLED: a node seeded from this template has not yet
+# been paired with anyone, and pulling a partner's confs before the partnership exists is either
+# a no-op or a surprise. The onboard flow arms it once the pairing is real.
+    CONF_SYNC_ENABLED=false
 
 # ── Arr Sync ──
 # arr_sync.sh syncs Lidarr/Sonarr/Radarr libraries across all nodes bidirectionally.
 # Runs before rsync — all nodes agree on tracked library before files are transferred.
 # Remote API keys are read live from each node's config.xml via SSH — never stored here.
-    ARR_SYNC_ENABLED=true
+# Ships OFF. Bidirectional means a fresh node with an empty library is an equal party to the
+# merge, and "all nodes agree on tracked library" is not something you want decided by the node
+# that knows nothing. Onboard Step 9 runs arr_sync explicitly during bootstrap; this gate is for
+# the unattended runs afterwards.
+    ARR_SYNC_ENABLED=false
     ARR_SYNC_BLOCKLIST="${DB_DIR}/arr_sync_blocklist.tsv"
     ARR_SYNC_CONNECT_TIMEOUT=10     # seconds — SSH connect timeout per node
     ARR_SYNC_API_TIMEOUT=60         # seconds — curl timeout for library fetches
@@ -624,7 +631,13 @@
 #   FALLBACK_RSYNC_ENABLED=true       ← handback writeback still works
 #   → Run individual: bash Rsync/rsync.sh /mnt/user/Movies
 #   → When ready: INTERMEDIATE_RSYNC_ENABLED=true  DAILY_RSYNC_ENABLED=true
-    RSYNC_ENABLED=true                  # Tier 1 — global gate, overrides everything below
+#   NOTE ON THE DEFAULT: Tier 1 ships OFF. This template is what a brand-new node is seeded from
+#   (Manual-Deployment.md — "Rebuilding a Wiped Node"), and a node that has just been stood up has
+#   empty shares and an unverified partner. Defaulting the global gate ON meant a fresh install
+#   started transferring — with --delete in the mix — before anyone had looked at it. Tier 2 stays
+#   ON so the structure is intact the moment you do arm Tier 1; this mirrors HOST1's live posture.
+#   Changing this default cannot affect an existing node: conf_upgrade KEEPS values already set.
+    RSYNC_ENABLED=false                 # Tier 1 — global gate, overrides everything below
     CRITICAL_RSYNC_ENABLED=true         # Tier 2 — critical_sync_maintenance.sh rsync section
     INTERMEDIATE_RSYNC_ENABLED=true     # Tier 2 — intermediate_sync_maintenance.sh rsync section
     DAILY_RSYNC_ENABLED=true            # Tier 2 — daily_sync_maintenance.sh rsync section