Let a non-blocking checklist item be dismissed with a recorded decision, and run discovery on the mirror once there is something to discover

Plugin/unraid/api/checklist.php

@@ -232,6 +232,42 @@ if (!empty($host2)) {
     ];
 }
 
-$allOk = !in_array(false, array_column($items, 'ok'), true);
+// ── Blocking vs deferrable ────────────────────────────────────────────────────
+// Setup used to be complete only when every item was green, which made a media-server API key a
+// gate on finishing onboarding. A mirror that runs no Emby, or runs one the operator has not got
+// round to configuring, could never reach "complete" — and the checklist is what tells them
+// whether they are done.
+//
+// Blocking items are the ones the mesh genuinely cannot work without: who this host is, its conf,
+// its SSH key, the owner's master.conf, and the partnership itself. Everything else improves the
+// install without being load-bearing, and can be dismissed with a recorded decision.
+//
+// Deferring is per item and reversible, stored in the setup state so it survives a reload. The
+// item still shows — amber, "deferred" — rather than disappearing, because a dismissed item is a
+// decision to revisit, not a thing that stopped being true.
+$deferrable = ['api_key' => true, 'populated' => true, 'emby_key' => true, 'jellyfin_key' => true];
+$state      = vv_setup_state_read();
+
+foreach ($items as &$item) {
+    $canDefer        = !empty($deferrable[$item['id']]);
+    $item['blocking'] = !$canDefer;
+    $item['deferred'] = $canDefer && !$item['ok']
+                        && !empty($state['DEFER_' . strtoupper($item['id'])]);
+    if ($item['deferred']) {
+        $item['detail'] = ($item['detail'] ?? '') . ' — deferred';
+        $item['action'] = 'undefer';
+    } elseif ($canDefer && !$item['ok']) {
+        // Keep the item's real action as the primary; the UI offers defer alongside it.
+        $item['can_defer'] = true;
+    }
+}
+unset($item);
+
+// Complete when every blocking item is green and every deferrable one is green or dismissed.
+$allOk = true;
+foreach ($items as $i) {
+    if ($i['ok']) continue;
+    if ($i['blocking'] || empty($i['deferred'])) { $allOk = false; break; }
+}
 
 echo json_encode(['ok' => true, 'complete' => $allOk, 'host_id' => $hostId, 'items' => $items]);

Plugin/unraid/api/setup.php

@@ -195,6 +195,39 @@ if ($action === 'populate') {
     exit;
 }
 
+// ── POST: defer / undefer a non-blocking checklist item ───────────────────────────────────────
+// Records the operator's "not now" so the checklist can reach complete without the item being
+// green. Only the ids api/checklist.php marks deferrable are accepted — a blocking item cannot be
+// dismissed, because dismissing it would report a mesh as ready when it cannot function.
+if ($action === 'defer' || $action === 'undefer') {
+    // POST only, and not merely by convention: $action is taken from GET too, and Unraid's CSRF
+    // guard checks POST alone. A GET-reachable mutation here would let any page the operator
+    // visits silently dismiss a checklist item.
+    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+        echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
+        exit;
+    }
+    $allowed = ['api_key', 'populated', 'emby_key', 'jellyfin_key'];
+    $item    = trim($_POST['item'] ?? '');
+    if (!in_array($item, $allowed, true)) {
+        echo json_encode(['ok' => false, 'error' => 'Not a deferrable item: ' . $item]);
+        exit;
+    }
+    $state = vv_setup_state_read();
+    $key   = 'DEFER_' . strtoupper($item);
+    if ($action === 'defer') {
+        $state[$key] = (string)time();          // when, not just whether — a stale decision shows its age
+    } else {
+        unset($state[$key]);
+    }
+    if (!vv_setup_state_write($state)) {
+        echo json_encode(['ok' => false, 'error' => 'Failed to write setup state']);
+        exit;
+    }
+    echo json_encode(['ok' => true, 'item' => $item, 'deferred' => $action === 'defer']);
+    exit;
+}
+
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
     exit;

Plugin/unraid/include/config.php

@@ -226,10 +226,14 @@ function vv_setup_state_read(): array {
 }
 
 // Write the setup state file (creates or overwrites).
-function vv_setup_state_write(array $data): void {
+// Returns whether the write landed. Was void, so a caller had no way to tell a full flash or a
+// read-only mount from success — and `if (!vv_setup_state_write(...))` on a void function is
+// always true, which turns "it worked" into a reported failure. Existing void callers are
+// unaffected by the added return.
+function vv_setup_state_write(array $data): bool {
     $content = '';
     foreach ($data as $k => $v) $content .= "$k=$v\n";
-    file_put_contents(VV_SETUP_STATE_FILE, $content);
+    return file_put_contents(VV_SETUP_STATE_FILE, $content) !== false;
 }
 
 // Push the setup state file to all remote hosts via scp.

Plugin/unraid/pages/setup.php

@@ -446,16 +446,40 @@ const vvActionHref = {
   onboard:   '?tab=partnership',
 };
 
+// URLSearchParams, not FormData — a FormData fetch POST hangs on this platform with no status
+// and no server-side trace. The fetch shim in Varaverk.page adds the CSRF header either way.
+function vvDeferItem(btn, id, defer) {
+  btn.disabled = true;
+  btn.textContent = defer ? 'Deferring…' : 'Restoring…';
+  fetch('/plugins/varaverk/api/setup.php', {
+    method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+    body: new URLSearchParams({action: defer ? 'defer' : 'undefer', item: id})
+  }).then(r => r.text()).then(text => {
+    if (!text.trim()) throw new Error('Empty response — request rejected before it reached setup.php');
+    const d = JSON.parse(text);
+    if (!d.ok) throw new Error(d.error || 'Unknown error');
+    vvLoadChecklist();
+  }).catch(e => {
+    btn.disabled = false;
+    btn.textContent = defer ? 'Not now' : 'Undo';
+    vvAlert('Could not update: ' + e.message);
+  });
+}
+
 function vvLoadChecklist() {
   fetch('/plugins/varaverk/api/checklist.php?_=' + Date.now())
     .then(r => r.json()).then(d => {
       const el = document.getElementById('vv-checklist');
       if (!d.ok || !d.items) { el.innerHTML = '<span style="color:#555">Unable to load checklist</span>'; return; }
       el.innerHTML = d.items.map(item => {
-        const icon = item.ok === null ? '○' : (item.ok ? '✓' : '✗');
-        const iclr = item.ok === null ? '#444' : (item.ok ? '#4a8' : '#a66');
+        // Deferred reads as its own state, not as pass and not as fail: the thing is still not
+        // done, the operator has said not now, and the row has to keep saying both.
+        const icon = item.deferred ? '–' : (item.ok === null ? '○' : (item.ok ? '✓' : '✗'));
+        const iclr = item.deferred ? '#a80' : (item.ok === null ? '#444' : (item.ok ? '#4a8' : '#a66'));
         let act = '';
-        if (item.action) {
+        if (item.action === 'undefer') {
+          act = `<div class="vv-cl-act"><button onclick="vvDeferItem(this,'${item.id}',false)">Undo</button></div>`;
+        } else if (item.action) {
           const lbl  = vvActionLabels[item.action] || item.action;
           const href = vvActionHref[item.action];
           if (href) {
@@ -471,6 +495,12 @@ function vvLoadChecklist() {
                 + `<div id="vv-ssh-out" class="vv-cl-err"></div></div>`;
           }
         }
+        // Offered alongside the real action, never instead of it — "not now" is a second choice
+        // on a row that still tells you how to do the thing.
+        if (item.can_defer) {
+          act += `<div class="vv-cl-act"><button onclick="vvDeferItem(this,'${item.id}',true)"
+                    style="background:#1a1400;border-color:#3a2e00;color:#a80;">Not now</button></div>`;
+        }
         return `<div class="vv-cl-item">
           <div class="vv-cl-icon" style="color:${iclr}">${icon}</div>
           <div class="vv-cl-body">