Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/fallback_state_reset.sh

@@ -22,6 +22,49 @@
 # covering the remote server until the next detection cycle.
 #
 # ==============================================================================================
+# OPERATIONAL MODEL
+# ==============================================================================================
+#
+#   1. Read and display the current state file so the operator sees what is being discarded
+#   2. Write a fresh state file:
+#        state=NORMAL, fallback_start=0, handback_strikes=0
+#        tier2_started=false, tier3_started=false, tier4_started=false
+#   3. Report the new state
+#
+# Nothing else is touched. No container is started or stopped, no DDNS is moved, no rsync
+# is run. fallback.sh picks the new state up on its next cycle and proceeds from NORMAL.
+#
+# ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# State File Only, Never Containers
+#   This tool changes what fallback.sh believes, not what is actually running. That
+#   separation is the point: reconciling the real stack is an operator judgement call,
+#   and a tool that tried to do both could act on a belief that was already wrong.
+#
+# The Operator Asserts Reality
+#   Resetting to NORMAL is a claim that the stack really is normal — right containers on
+#   the right host, DDNS pointing the right way. The script cannot verify that, so it
+#   shows the current state before overwriting it and leaves the check to the human. If
+#   the assertion is wrong, fallback.sh will act on a false NORMAL.
+#
+# Full Reset, Not Partial Edit
+#   Every field is rewritten rather than patching individual keys. A partially-reset file
+#   — NORMAL state with tier flags still true — is a state fallback.sh has no handling
+#   for and would be worse than either extreme.
+#
+# ==============================================================================================
+# CONFIGURATION
+# ==============================================================================================
+#
+# master.conf
+#
+#   FALLBACK_STATE_FILE
+#       Path to the fallback state file this tool rewrites. Shared with fallback.sh —
+#       both must agree or the reset writes somewhere fallback.sh never reads.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
@@ -40,9 +83,6 @@
 #   Interactive mode prompts for YES before writing. Use --force to bypass in
 #   non-interactive contexts (cron, scripts).
 #
-# Notification Validated
-#   platform_require_cmd confirms the notify script is present before use.
-#
 # ==============================================================================================
 # RUNTIME MODES
 # ==============================================================================================