Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Fallback/fallback_test.sh

@@ -41,9 +41,23 @@
 # ==============================================================================================
 #
 # iptables Safety Trap
-#   The DROP rule is removed via trap on ANY exit — normal completion, crash, error,
-#   ctrl-c. Remote connectivity is always restored regardless of test outcome.
-#   You cannot accidentally leave the remote permanently blocked.
+#   The DROP rule is removed via an EXIT trap that fires on normal completion, error
+#   exit, script crash, ctrl-c (SIGINT) and SIGTERM — verified, not assumed. Remote
+#   connectivity is restored regardless of test outcome.
+#
+# Stale Rule Sweep
+#   The trap above cannot cover SIGKILL or a power cut, which are the only ways a DROP
+#   rule survives the test. One stranded that way makes fallback.sh see the partner as
+#   permanently down and hold FALLBACK indefinitely, so pre-flight clears any leftover
+#   rule before doing anything else — including before the reachability check, which
+#   would otherwise fail and blame the network for the test's own residue.
+#
+# Root Enforcement
+#   iptables and container control require root.
+#
+# iptables Presence Check
+#   platform_require_cmd confirms iptables exists before the test begins — there is no
+#   point entering a connectivity simulation that cannot simulate anything.
 #
 # FALLBACK_ENABLED Gate
 #   Aborts if FALLBACK_ENABLED=false. Testing a disabled fallback system is
@@ -139,6 +153,28 @@ cleanup() {
 
 trap cleanup EXIT
 
+# ── Stale rule sweep — the one case the trap above cannot cover ───────────────────────────────
+# The EXIT trap fires on normal exit, error, ctrl-c and SIGTERM, but not on SIGKILL or a power
+# cut. A DROP rule stranded that way makes fallback.sh see the partner as permanently down and
+# sit in FALLBACK indefinitely — so clear any leftover from a previous run before starting.
+_clear_stale_block() {
+    [[ -z "${REMOTE_SERVER:-}" ]] && return
+    local removed=0
+    while iptables -C OUTPUT -d "$REMOTE_SERVER" -j DROP 2>/dev/null; do
+        if [[ "$DRY_RUN" == true ]]; then
+            warn "DRY RUN — would remove stale iptables block on $REMOTE_SERVER"
+            return
+        fi
+        iptables -D OUTPUT -d "$REMOTE_SERVER" -j DROP 2>/dev/null || break
+        (( removed++ ))
+    done
+    if [[ "$removed" -gt 0 ]]; then
+        warn "$ICON_SHIELD Removed $removed stale iptables block(s) on $REMOTE_SERVER from a previous run"
+        notify "Fallback test cleared $removed stale iptables block(s) on $(hostname) — a previous test was killed before cleanup" \
+            "Fallback Test" "warning"
+    fi
+}
+
 # ==============================================================================================
 # ━━━ Setup ━━━
 # ==============================================================================================
@@ -149,7 +185,8 @@ if [[ "$EUID" -ne 0 ]]; then
 fi
 
 # FALLBACK_ENABLED gate — no point testing if fallback is disabled
-if [[ "${FALLBACK_ENABLED:-false}" == false ]]; then
+# Fail-closed, matching fallback.sh — anything not exactly "true" counts as disabled.
+if [[ "${FALLBACK_ENABLED:-false}" != "true" ]]; then
     warn "FALLBACK_ENABLED=false — fallback test aborted"
     warn "Enable fallback in master.conf before running this test"
     exit 0
@@ -238,6 +275,11 @@ echo "━━━━━━━━━━━━━━━━━━━━━━━━
 echo ""
 echo "━━━ $ICON_SHIELD Phase 1 — Pre-flight ━━━"
 
+# Must run before the reachability check below — a stale DROP rule from a killed run makes
+# the partner look unreachable, and the test would abort blaming the network for its own
+# leftover.
+_clear_stale_block
+
 # Remote reachable
 if ping_remote; then
     log "$REMOTE_SERVER_NAME is reachable"