Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Orchestrators/weekly_sync_maintenance.sh

@@ -40,15 +40,35 @@
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
-#   Root check            — stop/start containers and rsync require root
-#   acquire_lock          — prevents concurrent weekly windows
-#   detect_hosts()        — MY_ID in banner, summary, and notifications
-#   check_connectivity    — verifies remote before any remote operations
-#   check_remote_rootfs   — aborts rsync if remote rootfs nearly full
-#   DOCKER_TIMEOUT        — all docker calls protected
-#   SSH_TIMEOUT           — all SSH calls protected
-#   platform_require_cmd  — notify validated before use
-#   Silent on success     — runs weekly; only failures warrant notification
+# Root Enforcement
+#   Container stop/start and rsync both require root.
+#
+# Lock Acquisition
+#   acquire_lock prevents concurrent weekly windows. This window stops Emby and the auth
+#   stack — two overlapping runs would fight over the same critical containers.
+#
+# Host Detection
+#   detect_hosts() sets MY_ID for the banner, summary and notifications.
+#
+# Empty Job List Guard
+#   Exits with an error and a notification if WEEKLY_MAINTENANCE_SCRIPTS is empty, rather
+#   than taking the weekly outage window and doing nothing with it.
+#
+# Connectivity Check
+#   check_connectivity verifies the remote before any remote operation is attempted.
+#
+# Remote Rootfs Check
+#   check_remote_rootfs aborts rsync if the remote rootfs is nearly full.
+#
+# Timeout Protection
+#   DOCKER_TIMEOUT bounds every docker call and SSH_TIMEOUT every SSH call, so neither a
+#   hung daemon nor an unresponsive partner can hold the weekly window open indefinitely.
+#
+# Non-Fatal Steps
+#   A failing job is recorded and the remaining jobs still run.
+#
+# Silent on Success
+#   Runs weekly; only failures warrant a notification.
 #
 # ==============================================================================================
 # CONFIGURATION
@@ -109,6 +129,16 @@ if ! command -v docker &>/dev/null; then
 fi
 
 detect_hosts
+
+# An unconfigured job list would run nothing and still report "0/0 passed" — indistinguishable
+# from a healthy run. Fail loudly instead of silently doing no work.
+if [[ ${#WEEKLY_MAINTENANCE_SCRIPTS[@]} -eq 0 ]]; then
+    error "WEEKLY_MAINTENANCE_SCRIPTS is empty — no weekly maintenance scripts will run"
+    error "Check WEEKLY_MAINTENANCE_SCRIPTS in master.conf"
+    notify "weekly maintenance scripts skipped on $(hostname) ($MY_ID) — WEEKLY_MAINTENANCE_SCRIPTS is empty" \
+        "$(basename "$0" .sh)" "warning"
+    exit 1
+fi
 resolve_remote_ip
 
 WINDOW_START=$(date +%s)