Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Orchestrators/watchdog_orchestrator.sh

@@ -49,11 +49,34 @@
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
-#   Root check       — watchdog operations require root
-#   acquire_lock     — strict; no pile-up if prior cycle still active
-#   detect_hosts()   — MY_ID in logs and notifications
-#   Array check      — exits early if /mnt/user is not shfs-mounted
-#   Startup grace    — WATCHDOG_STARTUP_GRACE respected before any checks
+# Root Enforcement
+#   Every watchdog launched from here requires root. Failing once at the top gives one
+#   clear error instead of the same permission failure repeated per child.
+#
+# Lock Acquisition
+#   acquire_lock in strict mode — if the previous cycle is still running, this one exits
+#   rather than queuing. At a one-minute cadence a waiting lock would pile up cycles
+#   behind a slow watchdog and eventually run them all at once.
+#
+# Host Detection
+#   detect_hosts() sets MY_ID for logs and notifications.
+#
+# Empty Job List Guard
+#   Exits with an error and a notification if WATCHDOG_ORCHESTRATOR_SCRIPTS is empty.
+#   Without it the cycle reports "0/0 passed" and exits 0 every minute — indistinguishable
+#   from a healthy run, while nothing at all is being monitored.
+#
+# Array Check
+#   Exits early if /mnt/user is not shfs-mounted. Watchdogs that inspect shares would
+#   otherwise read an unmounted array as missing data and act on it.
+#
+# Startup Grace
+#   WATCHDOG_STARTUP_GRACE is respected before any checks run, so containers still
+#   initialising after boot are not judged as unhealthy.
+#
+# Non-Fatal Steps
+#   run_orch_child() records a failing or missing watchdog and continues. One broken
+#   watchdog never suppresses the rest of the chain.
 #
 # ==============================================================================================
 # CONFIGURATION
@@ -104,6 +127,16 @@ acquire_lock
 
 detect_hosts
 
+# An unconfigured job list would run nothing and still report "0/0 passed" — indistinguishable
+# from a healthy run. Fail loudly instead of silently doing no work.
+if [[ ${#WATCHDOG_ORCHESTRATOR_SCRIPTS[@]} -eq 0 ]]; then
+    error "WATCHDOG_ORCHESTRATOR_SCRIPTS is empty — no watchdogs will run"
+    error "Check WATCHDOG_ORCHESTRATOR_SCRIPTS in master.conf"
+    notify "watchdogs skipped on $(hostname) ($MY_ID) — WATCHDOG_ORCHESTRATOR_SCRIPTS is empty" \
+        "$(basename "$0" .sh)" "warning"
+    exit 1
+fi
+
 log "$ICON_GEAR Config: grace=${WATCHDOG_STARTUP_GRACE}s heartbeat=${WATCHDOG_ORCHESTRATOR_HEARTBEAT:-true}/${WATCHDOG_ORCHESTRATOR_HEARTBEAT_HOURS:-1}hr scripts=${#WATCHDOG_ORCHESTRATOR_SCRIPTS[@]}"
 log "$ICON_WATCHDOG Order: $(for s in "${WATCHDOG_ORCHESTRATOR_SCRIPTS[@]}"; do printf '%s ' "${s##*/}"; done)"