Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Tools/ramdisk_stop.sh

@@ -30,6 +30,31 @@
 # lost on unmount — warn the user but proceed (this is expected for maintenance).
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Redirect Before Unmounting
+#   The symlink is pointed at the SSD fallback first, and only then is the tmpfs
+#   unmounted. Reversing that order would leave in-flight transcodes writing into a
+#   path that is being pulled out from under them. New sessions land on SSD from the
+#   moment of the flip; existing ones drain.
+#
+# Unmount Is the Data Loss
+#   Everything on a tmpfs disappears when it is unmounted — there is nothing to migrate
+#   and no way to preserve it. That is acceptable only because the contents are
+#   regenerable transcode segments, which is exactly why this operation is safe for
+#   transcodes and would not be for any other kind of ramdisk.
+#
+# Not Mounted Is Success
+#   An already-unmounted ramdisk is reported and treated as done, not as an error. The
+#   goal state is "ramdisk not mounted", and the script is idempotent toward it.
+#
+# State File Reflects Reality
+#   The transcode state file is updated to record the SSD target, so transcode_manager.sh
+#   agrees with what actually happened rather than trying to flip back to a ramdisk that
+#   no longer exists.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #