fix(e12): unbreak the gate, and stop printing a command that can strand the restore

Round five. 47 -> 34 -> 15 -> 7 -> 6 raw findings, and this round's sharpest was the
loop's own blind spot: **the branch did not pass the gate.** `prettier --check` is one of
its eight lanes and I had been running the other seven, so an unformatted `onError` from
round one sat on the branch for four rounds — `siftlode publish` would have refused it,
with no --skip flag to get past.

**The restart hint could still strand the restored data.** Round four said the scripts no
longer print a command they cannot resolve; they did. The COMPOSE_FILE fallback only fires
when `docker-compose.yml` is ABSENT, so in a source checkout it never fires and the hint
expanded to a bare, pasteable `docker compose up -d` — which reads the other file, whose
volumes are `pgdata`/`downloads` rather than `siftlode_pgdata`/`siftlode_downloads`, and
recreates the database on an empty one. When the file is unresolved the scripts now print
`-f <the compose file you started with>`: not runnable, which is the point.

**A comment naming the wrong owner.** `formats.py` still said a zero budget is "a refusal
for enqueue to make" — the premise round one disproved, three files away from the two
docstrings that now say the opposite. Anyone acting on it would delete the worker's refusal
and re-open the original inversion, so it now says where the refusal actually lives.

Also: the reset-flag rule was rewritten in three consecutive rounds and pinned by nothing —
two tests now cover a fragment losing its token, both by a pasted verify link and by
navigating away entirely; `backup.ps1` deletes a partially-copied dump before throwing, the
guard round four gave the docs but not the script it mirrors; and one comment that read as
if the asset were untouched by a line four below it.

Gate green, all eight lanes: ruff, ruff format, 3x tsc, eslint, prettier, knip,
vitest 687, pytest 950.

scripts/backup.ps1

@@ -46,7 +46,12 @@ if ($dumpCode -ne 0) {
 docker compose cp "db:$remote" $out
 $cpCode = $LASTEXITCODE
 Remove-RemoteDump $remote
-if ($cpCode -ne 0) { throw "BACKUP FAILED — could not copy the dump out of the container (exit $cpCode)." }
+# Remove the partial file: `cp` streams, so a mid-stream failure leaves a truncated dump under
+# the final name — non-zero length, so the size check below would not catch it either.
+if ($cpCode -ne 0) {
+    Remove-Item $out -ErrorAction SilentlyContinue
+    throw "BACKUP FAILED — could not copy the dump out of the container (exit $cpCode)."
+}
 if (-not (Test-Path $out) -or (Get-Item $out).Length -eq 0) {
     if (Test-Path $out) { Remove-Item $out }
     throw "BACKUP FAILED — the dump came out empty; no backup was written."

scripts/restore.ps1

@@ -63,10 +63,13 @@ if ($restoreCode -ne 0) {
     throw "pg_restore reported errors while restoring $DumpFile (exit $restoreCode) — read the output above before treating this instance as restored."
 }
 Write-Output "Restored $DumpFile"
-$cf = if ($env:COMPOSE_FILE) { " -f $env:COMPOSE_FILE" } else { "" }
-Write-Output "api and worker are stopped. Start them again the way you normally start Siftlode:"
-Write-Output "  docker compose$cf up -d"
-Write-Output "Use the SAME compose file you started with — 'up -d' recreates from whatever file it reads,"
+# Deliberately not a runnable line when we could not resolve the file: both compose files can be
+# present (a source checkout), and the two declare DIFFERENT volume names — so a pasted bare
+# 'docker compose up -d' would recreate the database on an empty volume and strand the restore.
+$cf = if ($env:COMPOSE_FILE) { $env:COMPOSE_FILE } else { "<the compose file you started with>" }
+Write-Output "api and worker are stopped. Start them again with:"
+Write-Output "  docker compose -f $cf up -d"
+Write-Output "It must be the SAME file you started with: 'up -d' recreates from whatever file it reads,"
 Write-Output "and a different one points at different volumes. Rolling a release back? Pin the older"
 Write-Output "IMAGE_TAG in .env FIRST: every start re-runs the migrations, and 'start' would relaunch the"
 Write-Output "existing container on the image you are rolling back FROM."

scripts/restore.sh

@@ -42,9 +42,16 @@ fi
 # not swallowed and not dressed up as success.
 if docker compose exec -T db pg_restore -U "$USER_NAME" -d "$DB_NAME" --clean --if-exists < "$FILE"; then
   echo "Restored $FILE"
-  echo "api and worker are stopped. Start them again the way you normally start Siftlode:"
-  echo "  docker compose ${COMPOSE_FILE:+-f $COMPOSE_FILE }up -d"
-  echo "Use the SAME compose file you started with — 'up -d' recreates from whatever file it reads,"
+  echo "api and worker are stopped. Start them again with:"
+  if [ -n "${COMPOSE_FILE:-}" ]; then
+    echo "  docker compose -f $COMPOSE_FILE up -d"
+  else
+    # Deliberately NOT a runnable line. Both compose files can be present (a source checkout), and
+    # the two declare DIFFERENT volume names — so a pasted bare 'docker compose up -d' would recreate
+    # the database on an empty volume and strand what was just restored.
+    echo "  docker compose -f <the compose file you started with> up -d"
+  fi
+  echo "It must be the SAME file you started with: 'up -d' recreates from whatever file it reads,"
   echo "and a different one points at different volumes. Rolling a release back? Pin the older"
   echo "IMAGE_TAG in .env FIRST: every start re-runs the migrations, and 'start' would relaunch the"
   echo "existing container on the image you are rolling back FROM."