Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no guard against a collapsed config value.
2026-08-01 20:37:59 -04:00
parent cdce877601
commit e8b114094a
78 changed files with 3301 additions and 277 deletions
@@ -37,6 +37,31 @@
 #   After REBOOT_VM_WAIT seconds, libvirt stops anyway — reboot takes priority.
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Warn, Do Not Block
+#   Pre-flight reports what is in flight — rsync running, mover running — and proceeds
+#   anyway. This is an operator-invoked tool: the person running it has already decided
+#   to reboot, and refusing would just push them to /sbin/reboot with no warning, no
+#   wall message and no clean array stop. The warnings name the specific script to run
+#   first (rsync_stop.sh, mover_stop.sh) so the safer path is the obvious one.
+#
+# Announce Before Acting
+#   A wall message and a notification go out REBOOT_SLEEP seconds ahead, both naming
+#   which host is rebooting and why. On a two-server setup "the server is rebooting" is
+#   ambiguous and therefore useless.
+#
+# Clean Array Stop First
+#   The reboot routes through the normal array stop sequence rather than calling
+#   /sbin/reboot directly. Array stop failures are reported and the reboot continues —
+#   an already-committed reboot should not be abandoned halfway, leaving services down
+#   and the machine still up.
+#
+# Flush Before Cutting Power
+#   sync runs immediately before /sbin/reboot so buffered writes reach disk.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #