rename: failover → fallback throughout codebase — this system is Fallback, state is FALLBACK; preserve conventional failover comparisons

Fallback/Manual-Fallback.md

@@ -352,7 +352,7 @@ ssh root@[HOST2-tailscale-ip] "docker inspect Emby --format '{{.State.Status}}'"
 
 ### 4. Critical Data Mirrored
 
-These shares must exist on HOST2 with current data from HOST1 before failover is needed:
+These shares must exist on HOST2 with current data from HOST1 before fallback is needed:
 
 ```
 /mnt/user/appdata-Fallback/Critical-Data    # auth stack — NPM, LLDAP, Authelia, certs
@@ -371,7 +371,7 @@ Sync is maintained continuously by `daily_sync_maintenance.sh` critical-data pro
 ### 5. DDNS TTL Set to 1 Minute
 
 Set in your DDNS provider settings. Higher TTL means users continue hitting the old IP
-for longer after failover. At 5-minute TTL, users can be hitting a downed server for up
+for longer after fallback. At 5-minute TTL, users can be hitting a downed server for up
 to 5 minutes before DNS switches.
 
 ### 6. Both Servers Running fallback.sh
@@ -398,7 +398,7 @@ current state, outage duration if not NORMAL, Tailscale reachability, and whethe
 fallback.sh is running.
 
 **Weekly health digest** (`weekly_health_digest.sh`) — reads the state file. If
-`DIGEST_SMART_ON_FAILOVER=true` and state is not NORMAL, it sends a notification even
+`DIGEST_SMART_ON_FALLBACK=true` and state is not NORMAL, it sends a notification even
 in smart mode — a non-NORMAL state at digest time needs attention.
 
 **Direct check:**
@@ -412,7 +412,7 @@ cat /boot/config/fallback_state.db    # raw state file
 
 ## ━━━ PROCEDURES ━━━
 
-### Running the Failover Test
+### Running the Fallback Test
 
 > This starts and stops real containers on both servers. Users will experience a brief
 > service interruption. Always run `--dry-run` first.

Fallback/README-Fallback.md

@@ -1,6 +1,6 @@
 # ━━━━━ FALLBACK ━━━━━
 
-Mutual automatic failover between two independent unRAID servers. When one goes down the
+Mutual automatic fallback between two independent unRAID servers. When one goes down the
 other starts its containers, cuts over DNS, and keeps users online. When it comes back
 everything hands back in the correct sequence — covering DDNS stops, containers stop, rsync
 writeback runs, containers start on the primary, primary DDNS starts last — so users hit the
@@ -45,7 +45,7 @@ The fix: stop containers before syncing. The outage window is only the rsync dur
 typically minutes. Clean static source at full bandwidth, predictable state every time.
 
 **No Way to Validate the System Before Needing It**  
-A failover system that has never been tested is not a failover system — it is a hope.  
+A fallback system that has never been tested is not a fallback system — it is a hope.  
 The fix: `fallback_test.sh` — a controlled simulation using an iptables DROP rule to make
 the remote appear unreachable, triggering the full sequence without taking anything offline.
 A safety trap removes the rule on any exit — crash, error, ctrl-c, or clean completion.