Bring script headers onto the template and close safeguard gaps

Headers claimed protections the code never had, and several destructive paths had no
guard against a collapsed config value.

Transcodes/ramdisk_setup.sh

@@ -30,6 +30,37 @@
 # /tmp resets on reboot — correct, transcode state should not persist across boots.
 #
 # ==============================================================================================
+# DESIGN PRINCIPLES
+# ==============================================================================================
+#
+# Size Is a Ceiling, Not a Reservation
+#   tmpfs allocates on write. RAMDISK_SIZE caps how large the ramdisk may grow; it does
+#   not take that RAM away from the system up front. Sizing it generously costs nothing
+#   until transcodes actually fill it, which is why the ceiling can sit well above
+#   normal usage without starving anything.
+#
+# Clean Symlink State Every Boot
+#   TRANSCODE_LINK is reset to the ramdisk at every array start rather than left wherever
+#   the last flip put it. transcode_manager.sh flips it to SSD under pressure, and that
+#   flip is a runtime response to a full ramdisk — carrying it across a reboot would mean
+#   starting on the fallback with an empty ramdisk sitting unused.
+#
+# Pre-Create Before Emby Starts
+#   transcoding-temp/ is created on the ramdisk before any container launches. Emby
+#   searches accessible paths for an existing transcoding-temp at startup and binds to
+#   the first it finds — if only the SSD copy exists, every session lands there until
+#   Emby is restarted. Ordering here is not cosmetic; it decides where transcodes go.
+#
+# Idempotent Re-Runs
+#   An already-mounted ramdisk is left mounted and only the symlink and permissions are
+#   verified. Re-running never tears down a mount that active sessions are writing into.
+#
+# State Belongs in /tmp
+#   The transcode state DB lives in /tmp and resets on reboot. Flip counters and the
+#   current target describe a running system; carrying them across a boot would make the
+#   manager act on pressure that no longer exists.
+#
+# ==============================================================================================
 # OPERATIONAL SAFEGUARDS
 # ==============================================================================================
 #
@@ -43,9 +74,6 @@
 #   If RAMDISK_PATH is already a mountpoint, reports status and exits cleanly
 #   without attempting to remount or changing anything.
 #
-# Notification Validated
-#   platform_require_cmd confirms the notify script is present before use.
-#
 # Silent on Success
 #   Startup script runs on every boot — no output when healthy.
 #
@@ -127,6 +155,23 @@ acquire_lock
 # detect_hosts() sets MY_ID and aliases RAMDISK_SIZE, TRANSCODE_SSD etc.
 detect_hosts
 
+# This script mounts a tmpfs over RAMDISK_PATH and, when TRANSCODE_LINK exists but is not a
+# symlink, rm -rf's it before replacing it. Neither of those checks catches a collapsed path:
+# / and /mnt both satisfy -e, and mounting a tmpfs over a system directory hides its contents
+# for the life of the mount. Require at least two path components before either is touched.
+for _tc_pair in "RAMDISK_PATH:$RAMDISK_PATH" "TRANSCODE_LINK:$TRANSCODE_LINK"; do
+    _tc_name="${_tc_pair%%:*}"
+    _tc_path="${_tc_pair#*:}"
+    _tc_slashes="${_tc_path//[^\/]/}"
+    if [[ -z "$_tc_path" || "$_tc_path" != /* || "${#_tc_slashes}" -lt 2 ]]; then
+        error "$_tc_name is unset or unsafe ('${_tc_path:-unset}') — refusing to mount or relink"
+        notify "Ramdisk setup aborted on $(hostname) ($MY_ID) — $_tc_name is '${_tc_path:-unset}'" \
+            "Ramdisk Setup" "warning"
+        exit 1
+    fi
+done
+unset _tc_pair _tc_name _tc_path _tc_slashes
+
 log "Identity:  $MY_ID ($LOCAL_SERVER_NAME)"
 log "Ramdisk:   $RAMDISK_PATH ($RAMDISK_SIZE)"
 log "Fallback:  $TRANSCODE_SSD"