Stop counting a gated-off critical rsync as an unreachable partner, and report the counter in the unit it is stored in

The guard tested Tier 1 only, so onboard Step 1d's posture — Tier 1 open, every Tier 2 closed — made a healthy partner climb toward auto-offboard every 30 minutes. The counter holds intervals, not days, and was rendered raw.

Orchestrators/critical_sync_maintenance.sh

@@ -250,11 +250,20 @@ if [[ "${PARTNERSHIP_ENABLED:-false}" == true ]]; then
     # only fault was that RSYNC_ENABLED=false. That is how a deliberately paused sync ends up
     # dismantling the partnership it was paused for. With no rsync attempt there is nothing to
     # report, so the check runs without touching the counter either way.
+    # Tier 2 counts as "switched off" here exactly as much as Tier 1 does. The guard below used
+    # to test RSYNC_ENABLED alone, but it is CRITICAL_RSYNC_ENABLED that governs whether this
+    # orchestrator attempts an rsync at all — so with Tier 1 open and Tier 2 closed, no transfer
+    # was attempted, RSYNC_OK stayed false, and the run fell through to --remote-unseen and
+    # incremented the counter every 30 minutes against a partner that was answering fine.
+    #
+    # Onboard Step 1d now leaves precisely that posture on purpose — Tier 1 open so provisioning
+    # can run, every Tier 2 gate closed so nothing is scheduled. A freshly onboarded, perfectly
+    # healthy partnership would have auto-offboarded itself 30 days later.
     if [[ "$RSYNC_OK" == true ]]; then
         bash "$SCRIPT_DIR/../Partnership/partnership_manager.sh" \
             --check --remote-seen $PARTNER_DRY
-    elif [[ "${RSYNC_ENABLED:-false}" != true ]]; then
-        echo "Rsync disabled — partnership check runs, offline counter untouched"
+    elif [[ "${RSYNC_ENABLED:-false}" != true || "${CRITICAL_RSYNC_ENABLED:-false}" != true ]]; then
+        echo "Critical rsync gated off — partnership check runs, offline counter untouched"
         bash "$SCRIPT_DIR/../Partnership/partnership_manager.sh" \
             --check $PARTNER_DRY
     else