Prompt:
<task-notification>
<task-id>a610a953782f7776f</task-id>
<tool-use-id>toolu_01Xk8rh8EYkVZFHVZVbJ8FEU</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/a610a953782f7776f.output</output-file>
<status>completed</status>
<summary>Agent "Audit Docker_Essentials + Deployment scripts vs headers" completed</summary>
<result>Now I'll analyze each script carefully, comparing the header documentation with the actual code.

## Audit Results

**✅ conf_upgrade.sh**
Header matches code exactly. All documented flags (--template, --target, --dry-run, --backup) are implemented and functional. Safeguards and atomic write behavior confirmed.

**✅ deploy.sh**
Header matches code. Both deployment modes (direct and hook-based) documented and implemented correctly.

**✅ docker_container_stop.sh**
Header matches code. All RUNTIME MODES (no flags, --dry-run, --status, --log) implemented. CONFIGURATION vars (RETRY_COUNT, SLEEP) properly used. Operational model of sequential graceful-then-force-kill is correct.

**docker_daily_restart.sh**
- HEADER: "RESTART_VERIFY_WAIT" listed in line 231 log statement: `verify-wait=${RESTART_VERIFY_WAIT}s`
- CODE: Variable `RESTART_VERIFY_WAIT` is never set or used anywhere except in this one log line. The actual verification happens immediately after restart (line 270) with `verify_running "$container"` and no wait period is applied.
- ISSUE: Documented and logged variable that is not implemented in the actual logic.

**✅ docker_network_connect.sh**
Header matches code. All runtime modes (no flags, --dry-run, --status, --log) implemented. Configuration vars and safeguards verified.

**docker_update.sh**
- HEADER (line 69-71): "DAILY_CONTAINER_UPDATES Toggle — Normal mode exits cleanly when disabled. docker_daily_restart.sh still runs regardless"
- CODE (line 201-204): Actually checks `DAILY_CONTAINER_UPDATES` and conditionally exits, but this is in normal mode (no --remainder flag). When disabled, the script exits with message "DAILY_CONTAINER_UPDATES=false" regardless of mode.
- ISSUE: Header doesn't clearly document that the toggle affects both normal and remainder modes, not just normal mode. Actually examining the code more carefully: remainder mode NEVER checks this toggle—it only checks in the normal (non-remainder) path. This is correct behavior and matches header intent.
- NO ISSUE: Rechecking reveals header is accurate.

**✅ docker_update_remaining.sh**
Header matches code. WEEKLY_REMAINING_UPDATES toggle, configuration, and runtime modes all correct.

**docker_weekly_restart.sh**
- HEADER (line 257-258): "stopped → leave, missing → skip. Container state is always respected."
- CODE (line 256-259): Shows `false)` branch with comment "Container was stopped — leave it stopped" and adds to SKIPPED array.
- ISSUE: Log message at line 258 says "respecting stopped state" but this contradicts line 16 which says the script has no authority to override intentionally stopped containers. The behavior is correct but the message at line 258 uses inconsistent language. Actually, reading carefully: line 16 says "Stopped containers are left stopped — they were intentionally halted" and line 258 says "respecting stopped state"—these align perfectly.
- NO ISSUE: Both header and code are consistent.

**downloaders_reset.sh**
- HEADER (line 79-80): "acquire_lock 'wait' — waits for previous run to finish since this runs every 15 minutes"
- HEADER (line 12-13): "Called every 30 minutes by critical_sync_maintenance.sh"
- CODE (line 141): `acquire_lock "wait"` is correct
- INCONSISTENCY: Header says script runs every 15 minutes (line 80) but also says it's called every 30 minutes (line 13). These are contradictory claims about the same frequency.
- ISSUE: Internal documentation contradiction about execution frequency (15 vs 30 minutes).

---

## Summary Report

**docker_daily_restart.sh**
- Header references `RESTART_VERIFY_WAIT` in configuration/logging (line 231) but this variable is never defined or used in the verification logic. The actual restart verification happens without any wait period.

**downloaders_reset.sh**
- Contradictory frequency claims in header: line 13 says "every 30 minutes" but line 80 says "every 15 minutes"</result>
<usage><subagent_tokens>49170</subagent_tokens><tool_uses>9</tool_uses><duration_ms>21407</duration_ms></usage>
</task-notification>


Prompt:
<task-notification>
<task-id>ab976a3a2d54c1360</task-id>
<tool-use-id>toolu_01PXKroTHghnN2Zx1dwb7CeZ</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/ab976a3a2d54c1360.output</output-file>
<status>completed</status>
<summary>Agent "Audit Fallback + Kernel + Rsync + load_config scripts vs headers" completed</summary>
<result>Now I'll compile my audit findings:

## Audit Report: Bash Script Header Discrepancies

### /boot/config/plugins/varaverk/Fallback/fallback.sh
- **CONFIGURATION issue**: Header documents `FALLBACK_HOST*_TIER2_DELAY / TIER3_DELAY / TIER4_DELAY` as "References the remote host's ID" but the code actually uses `get_tier2_delay()` etc which call `${REMOTE_ID}_TIER2_DELAY` — this is correct behavior but the phrasing in the header is confusing and inaccurate. Header should say "Keyed by REMOTE_ID: e.g., HOST2_TIER2_DELAY when local server is covering HOST2"

- **CONFIGURATION issue**: Header lists `FALLBACK_HOST*_WRITEBACK_TIER1–4` with variable pattern `FALLBACK_${REMOTE_ID}_WRITEBACK_TIER${N}` but the actual code at lines 565-576 shows Tier 4 specially uses `HOST*_DAILY_SYNC_SHARES` (line 570: `local shares_var="${remote_id}_DAILY_SYNC_SHARES"`). Header is missing this detail that Tier 4 auto-uses DAILY_SYNC_SHARES.

### ✅ /boot/config/plugins/varaverk/Fallback/fallback_test.sh
Header and code match perfectly.

### ✅ /boot/config/plugins/varaverk/Kernel/decision_engine.sh
Header and code match perfectly.

### /boot/config/plugins/varaverk/Rsync/rsync.sh
- **CONFIGURATION issue**: Header CONFIGURATION section lists `PROFILE_RSYNC_OPTS` saying "does not inherit DEFAULT_RSYNC_OPTS" but this is explained only in comments. Code at line 1317 in common.sh confirms this: `read -r -a RSYNC_OPTS <<< "${PROFILE_RSYNC_OPTS[$PROFILE_NAME]}"` uses profile opts directly without merging defaults. Header is correct but could be clearer.

- **RUNTIME MODES issue**: Header documents `--log` flag (line 128) but the code at line 228 shows it's processed by `parse_args` from common.sh which sets `ENABLE_LOGGING=true`. This is actually implemented correctly, just indirectly through common.sh.

### ✅ /boot/config/plugins/varaverk/load_config.sh
Header and code match perfectly. The loader documentation is comprehensive and accurate.

### ✅ /boot/config/plugins/varaverk/common.sh
Extensive header documentation at lines 1-94 matches all code. All output helpers, arg parser, validation helpers, host detection, and connectivity functions are documented and implemented correctly.

### ✅ /boot/config/plugins/varaverk/git_pull_execute.sh
Header and code match perfectly.

---

## Summary

**Real discrepancies found: 2**

1. **fallback.sh line 159**: Header claims `HOST*_TIER2_DELAY / TIER3_DELAY / TIER4_DELAY` "References the remote host's ID" but doesn't clearly explain this means the variable is named with the REMOTE_ID prefix (e.g., `HOST2_TIER2_DELAY` not `FALLBACK_HOST2_TIER2_DELAY`).

2. **fallback.sh lines 565-576**: Header omits that Tier 4 writeback automatically includes `HOST*_DAILY_SYNC_SHARES` without requiring a separate `FALLBACK_${REMOTE_ID}_WRITEBACK_TIER4` list—this is a real feature that should be documented in CONFIGURATION.</result>
<usage><subagent_tokens>78916</subagent_tokens><tool_uses>8</tool_uses><duration_ms>20056</duration_ms></usage>
</task-notification>


<task-notification>
<task-id>aa134018ac187b545</task-id>
<tool-use-id>toolu_01KXb2hNX5wcVhG1u8nWXJs5</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/aa134018ac187b545.output</output-file>
<status>completed</status>
<summary>Agent "Audit Media scripts vs headers" completed</summary>
<result>Now I'll analyze each script carefully against its header documentation.

## Audit Report

**✅ arr_sync.sh**

**✅ arrs_failed_stalled_recovery.sh**

**lidarr_cleanup.sh**
- PURPOSE header claims "Triggers an Emby library clean after each deletion run" but the code at line 605 calls `notify_emby_scan` only if `$TOTAL_REMOVED` is greater than 0 and NOT in DRY_RUN mode. The header's claim of "after each deletion run" is misleading — it's only after actual deletions, not after every run.

**✅ lidarr_missing_art.sh**

**✅ media_cleaner.sh**

**✅ media_shares_permissions.sh**

**play_state_sync.sh**
- CONFIGURATION header lists "PLAY_SYNC_REMOTE" with default "true" and description "Sync across all hosts via Tailscale (default: true) false = local servers only". Code at line 92 uses `"${PLAY_SYNC_REMOTE:-true}"` which matches the default documented. However, at line 125 the logic says `if [[ "$_is_me" == false && "${PLAY_SYNC_REMOTE:-true}" != "true" ]]; then` which skips remote hosts when PLAY_SYNC_REMOTE is false. The header description is correct and matches code — no issue here.
- CONFIGURATION missing from header: `emby_api` function is called (lines 322, 505, 315, 329) but this helper is not documented anywhere in the header as a required/available function.

**playback_aware_lidarr_discovery.sh**
- CONFIGURATION header lists "LIDARR_DISCOVERY_HISTORY" with path description but does not mention it's auto-created in DATA_DIR if not specified (line 159: `"${LIDARR_DISCOVERY_HISTORY:-${DATA_DIR}/lidarr_discovery_history.db}"`). Not a mismatch, just incomplete.

**playback_aware_radarr_discovery.sh**
- CONFIGURATION header claims "RADARR_DISCOVERY_SEED_LIBRARIES — Emby library names to draw seeds from (default: ("Movies"))" but code at line 163 sets `SEED_LIBRARIES=("${RADARR_DISCOVERY_SEED_LIBRARIES[@]:-Movies}")` which defaults to "Movies" string, not an array. Minor: the notation in header shows `("Movies")` implying an array but the default is the string "Movies" which becomes a single-element array in bash. Technically correct but notation is slightly misleading.

**playback_aware_sonarr_discovery.sh**
- CONFIGURATION header claims "SONARR_EMBY_LIBRARIES — Emby library names to draw seeds from" but code at line 169 checks `if [[ "${#SONARR_EMBY_LIBRARIES[@]}" -eq 0 ]]; then error "SONARR_EMBY_LIBRARIES not configured"`. The header does NOT list this as required in CONFIGURATION section (lines 69-82), though it IS documented in the FLOW section. This is a documentation inconsistency — a required config should be listed in CONFIGURATION section.

**radarr_cleanup.sh**
- CONFIGURATION header does NOT list "RADARR_IMPORT_SCAN_TIMEOUT" in the master.conf section, but code at line 335 uses `POLL_TIMEOUT=${RADARR_IMPORT_SCAN_TIMEOUT:-600}`. The header documents this variable in lidarr_cleanup.sh (line 76 of that file) but NOT in radarr_cleanup.sh's header.

**✅ radarr_tmdb_removed.sh**

**sonarr_cleanup.sh**
- Same issue as radarr_cleanup.sh: CONFIGURATION header does NOT list "SONARR_IMPORT_SCAN_TIMEOUT" in the master.conf section, but code at line 335 uses `POLL_TIMEOUT=${SONARR_IMPORT_SCAN_TIMEOUT:-600}`.

**sonarr_tvdb_removed.sh**
- CONFIGURATION header at line 38-39 lists "SONARR_DROPPED_ADD_EXCLUSION" but the parameter name used in code at line 198 is `addImportListExclusion` while in radarr_tvdb_removed.sh line 196 it's `addImportExclusion`. Both APIs are called, but the parameter names differ between arr types. This is not a documentation error but worth noting the APIs differ.

## Summary

**lidarr_cleanup.sh**
- Emby library clean notification only happens after actual deletions, not "after each deletion run" as header claims

**play_state_sync.sh**
- Missing documentation: `emby_api` helper function is called but not documented as required/available

**playback_aware_sonarr_discovery.sh**
- SONARR_EMBY_LIBRARIES is required (script exits if empty) but not listed in CONFIGURATION section, only mentioned in FLOW section

**radarr_cleanup.sh**
- Missing from CONFIGURATION: RADARR_IMPORT_SCAN_TIMEOUT (used in code at line 335)

**sonarr_cleanup.sh**
- Missing from CONFIGURATION: SONARR_IMPORT_SCAN_TIMEOUT (used in code at line 335)</result>
<usage><subagent_tokens>126003</subagent_tokens><tool_uses>14</tool_uses><duration_ms>24117</duration_ms></usage>
</task-notification>


<task-notification>
<task-id>a41f0ff6991d1474c</task-id>
<tool-use-id>toolu_015C3Z83Fgu8UwxDx9p8Nhkq</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/a41f0ff6991d1474c.output</output-file>
<status>completed</status>
<summary>Agent "Audit Partnership scripts vs headers" completed</summary>
<result>Now I'll audit each script systematically, comparing the header documentation against the actual code implementation.

## Audit Results

**onboard_cancel.sh**
- ✅ Script header and code align correctly

**partnership_manager.sh**
- Issue 1: Header claims `--unblock <hostname>` at line 184, but the code implements it as `--unblock` followed by positional argument (lines 224-225). Header is accurate, code works as documented.
- Issue 2: Header at line 131 lists "PARTNERSHIP_ONBOARD_VERIFY" as defaulting to `true`, but line 1254 checks `"${PARTNERSHIP_ONBOARD_VERIFY:-true}"` which only defaults to `true` if undefined. The header claim is correct and the code implements it.
- ✅ Operationally accurate

**partnership_offboard.sh**
- Issue: Header states Step 7 on line 24 is "Remote cleanup — remove auth/arr stack + fallback containers from mirror" but the code at line 441-443 calls two separate functions: `cleanup_deployed_stack_on_remote` (for auth/arr) and `cleanup_owner_containers_on_mirror` (for owner-deployed containers). The header doesn't mention `cleanup_owner_containers_on_mirror` explicitly, though it is described generically as "auth/arr stack + fallback containers". However, the actual execution splits this into two distinct functions with different logic. This is functional but the description could be clearer. The code does what the header claims, just via two sub-functions rather than a single operation.
- ✅ Functionally accurate despite implementation detail

**partnership_onboard.sh**
- Issue: Header at line 22-32 states "OWNER PATH (10 steps)" but the actual OWNER path in code execution (lines 377-677) shows the numbered steps don't align cleanly: Lines 379-431 handle Step 1 (SSH), then Step 2 at line 506 (stop auth), Step 3 at line 516 (deploy auth), Step 4 at line 534 (stop arr), Step 5 at line 547 (deploy arr), Step 6 at line 561 (stop services), Step 7 at line 574 (deploy services), Step 8 at line 588 (partnership onboard), Step 9 at line 600 (arr bootstrap), Step 10 at line 620 (conf push). The step numbers match the header claim of 10 steps, so this is accurate.
- ✅ Script header matches code

**partnership_transfer.sh**
- Issue: Header at line 75-76 states "CRITICAL_SYNC_SHARES" is in CONFIGURATION, and line 252 calls `do_final_sync` which uses this array. However, the header does not list PARTNERSHIP_AUTH_WEBUIS in CONFIGURATION (line 79 mentions it in CONFIGURATION under partnership_manager.sh context, but this script's CONFIGURATION section lines 60-80 does list "PARTNERSHIP_AUTH_WEBUIS" at line 79). Actually, reading carefully: the CONFIGURATION section properly lists CRITICAL_SYNC_SHARES at line 75 and PARTNERSHIP_AUTH_WEBUIS at line 79. This is correct.
- ✅ Accurate

**ssh_setup.sh**
- Issue: Header claims "--local-only" mode at line 56, but the header documentation at lines 12-37 does not list "--local-only" as a runtime mode. However, the code does parse it at line 56 and implements it at lines 325-335 with fallback behavior. The mode is undocumented in the header MODES section.
- Issue 2: Header does not document the return value `exit 2` behavior, but code at line 267 returns `exit 2` when max strikes is reached. The STRIKE SYSTEM section (lines 19-26) mentions "return exit 2 (caller can escalate)" at line 25, so this IS documented. Not an issue.
- ✅ Mostly accurate; --local-only exists but isn't in the MODES section header

---

## Summary

**onboard_cancel.sh**
✅ onboard_cancel.sh

**partnership_manager.sh**
✅ partnership_manager.sh

**partnership_offboard.sh**
✅ partnership_offboard.sh

**partnership_onboard.sh**
✅ partnership_onboard.sh

**partnership_transfer.sh**
✅ partnership_transfer.sh

**ssh_setup.sh**
- Header RUNTIME MODES section (lines 32-37) does not document the `--local-only` flag, though it is implemented in the code (line 56) and functional (lines 325-335). The flag should be added to the documented runtime modes.</result>
<usage><subagent_tokens>63398</subagent_tokens><tool_uses>6</tool_uses><duration_ms>18389</duration_ms></usage>
</task-notification>


<task-notification>
<task-id>ab0cb2ddc7ba3d038</task-id>
<tool-use-id>toolu_01DyU4J1EcDxrX1H1BEKUPp7</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/ab0cb2ddc7ba3d038.output</output-file>
<status>completed</status>
<summary>Agent "Audit Monitors + Orchestrators scripts vs headers" completed</summary>
<result>Now let me analyze all the scripts systematically for discrepancies.

## Audit Report

Based on my review of all 19 bash scripts, here are the real discrepancies between header documentation and actual code:

**Monitors:**

✅ backup_verify.sh

✅ bandwidth_monitor.sh

cert_monitor.sh
- Header states "RUNTIME MODES: cert_monitor.sh --log — Verbose per-domain output during the run" but no actual logging of per-domain details occurs—the script only outputs when --log is passed but the code doesn't change behavior based on VERBOSE/ENABLE_LOGGING flags from parse_args.

✅ emby_session_report.sh

✅ mesh_monitor.sh

✅ smart_health.sh

✅ system_tuning_monitor.sh

weekly_health_digest.sh
- Header lists "DIGEST_SMART_ON_BANDWIDTH" as config but code never uses this variable (line 300-305 only checks if FAILED_COUNT > 0, not DIGEST_SMART_ON_BANDWIDTH). Line 289 references an undefined variable when filtering BANDWIDTH_LOG: column $7 is tested for "LARGE" but the new log format documented at line 289 is "date|time|profile|duration|status|bytes|warn_flag" — column $7 exists and is correct, but the logic doesn't match the documented DIGEST_SMART_ON_BANDWIDTH gate.

zfs_memory_snapshot.sh
- Header states "Output goes to both console (for User Scripts output log) and ZFS_REPORT_LOG for week-over-week comparison" but when DRY_RUN=true (line 150), the tee is never executed, so normal --dry-run output still goes to console. The header claim about "both console and log" implies log write during dry-run, which doesn't happen.

**Orchestrators:**

✅ array_started.sh

✅ array_stopping.sh

✅ critical_sync_maintenance.sh

✅ daily_sync_maintenance.sh

✅ intermediate_sync_maintenance.sh

✅ monthly_maintenance.sh

sunday_morning_coffee_report.sh
- Header at line 45 states flag is "--log" but code at line 45 checks ENABLE_LOGGING (which comes from parse_args), and line 44 uses variable name ENABLE_LOGGING while the rest of the system uses VERBOSE. The actual flag is parsed as --log, so the documentation is correct, but variable naming is inconsistent.

✅ transcode_management.sh

watchdog_orchestrator.sh
- Header at line 41 lists config "WATCHDOG_ORCHESTRATOR_HEARTBEAT_HOURS" but code only defines WATCHDOG_ORCHESTRATOR_HEARTBEAT_HOURS with a fallback to 1 (line 187). However, the code never validates this is set, and line 187 uses `${WATCHDOG_ORCHESTRATOR_HEARTBEAT_HOURS:-1}` correctly. The header is accurate.

✅ weekly_sync_maintenance.sh

---

**Summary of Real Discrepancies:**

1. **cert_monitor.sh** — Header documents `--log` flag produces "verbose per-domain output" but the code doesn't actually change output behavior based on VERBOSE flag.

2. **weekly_health_digest.sh** — Header documents DIGEST_SMART_ON_BANDWIDTH config variable but it's never used in the code (bandwidth section always notifies on large transfers regardless of this gate).

3. **zfs_memory_snapshot.sh** — Header states output goes to "both console and log file" but during --dry-run, output only goes to console (line 147 tee is skipped).</result>
<usage><subagent_tokens>91346</subagent_tokens><tool_uses>19</tool_uses><duration_ms>27067</duration_ms></usage>
</task-notification>


Two groups done, four still running. Collecting results as they come in.


lets go through each bash script and check that the script does what the header says it does


Monitor media server sync and backup health


<task-notification>
<task-id>a8a7d3075411b441b</task-id>
<tool-use-id>toolu_01V4k5sbVHW2hT8MLa2NovKr</tool-use-id>
<output-file>/tmp/claude-0/-root/685e6c5b-62c1-40bd-9cfd-2c9f7e15c50f/tasks/a8a7d3075411b441b.output</output-file>
<status>completed</status>
<summary>Agent "Audit System_Essentials + Tools + Transcodes + Watchdogs scripts vs headers" completed</summary>
<result>Now I have reviewed all the scripts. Let me compile my findings:

## Audit Report: Bash Script Header Documentation vs Code

Based on a thorough review of all 27 scripts, here are the discrepancies found between header documentation and actual code implementation:

### System_Essentials/

**✅ clear_logs.sh** — Header matches code exactly.

**✅ conf_sync.sh** — Header matches code exactly.

**✅ docker_syslog_filter.sh** — Header matches code exactly.

**✅ inotify_tuning.sh** — Header matches code exactly.

**rsync_stop.sh**
- Header documents "rsync-only" mode as detecting orchestrators and killing only rsync, but code at line 260 enters "full-stop" mode when orchestrators are detected. Header claims orchestrator-only mode triggers rsync-only, but code does the opposite (line 252: when LOCAL_ORCH or REMOTE_ORCH found, mode = "rsync-only" is correct, but line 250 shows if FULL_STOP==true then MODE="full-stop", suggesting the conditional logic might be backwards from the header's stated behavior).

**✅ server_reboot.sh** — Header matches code exactly.

### Tools/

**✅ bulk_permissions_repair.sh** — Header matches code exactly.

**✅ claude_startup.sh** — Header matches code exactly.

**✅ container_data_export.sh** — Header matches code exactly.

**docker_prune_images.sh**
- Header CONFIGURATION section is completely missing. Header lists no config variables, but code never references any config either, so this is technically not a discrepancy — just sparse documentation.

**emby_database_repair.sh**
- Header states "Does NOT automatically repair" but header's OPERATIONAL SAFEGUARDS section claims "Guaranteed Restart" via EXIT trap. Code does implement this (line 186), but the header could be clearer that the database is never modified — only integrity checked.

**✅ emby_to_lidarr_sync.sh** — Header matches code exactly.

**✅ emby_to_radarr_sync.sh** — Header matches code exactly.

**✅ emby_to_sonarr_sync.sh** — Header matches code exactly.

**✅ fallback_state_reset.sh** — Header matches code exactly.

**ramdisk_stop.sh**
- Header claims STATE_FILE points to `/tmp/transcode_state.db` but code (line 109) defines it as `${TRANSCODE_STATE_FILE:-${STATE_DIR:-/tmp}/transcode_state.db}`. Header doesn't mention TRANSCODE_STATE_FILE or STATE_DIR variables, only hardcoding /tmp assumption.

**smart_long_test.sh**
- Header CONFIGURATION mentions `SMART_TEMP_WARN / SMART_TEMP_CRIT` as "fallback thresholds used for post-test temperature reporting" but code never reads or uses these variables anywhere in the script. Appears to be documented but unimplemented.

**watchdog_skip_list_manager.sh**
- Header RUNTIME MODES claims `watchdog_skip_list_manager.sh [--status]` but code (lines 81-100) parses `--status` but ACTION defaults to "status" by default, so both `watchdog_skip_list_manager.sh` and `watchdog_skip_list_manager.sh --status` do the same thing. Header could clarify this.

**✅ zfs_pool_scrub.sh** — Header matches code exactly.

### Transcodes/

**ramdisk_setup.sh**
- Header STATE FILES section mentions the file at `/tmp/transcode_state.db` but code (line 326) uses `${TRANSCODE_STATE_FILE:-${STATE_DIR:-/tmp}/transcode_state.db}`. Header doesn't document these variables.

**transcode_cleanup.sh**
- Header claims lsof call uses 15-second timeout for "active file check" but code (line 194) uses `timeout 15` which would timeout the entire lsof call if it takes that long — the description is misleading about what happens on timeout.

**transcode_manager.sh**
- Header PURPOSE and OPERATIONAL MODEL are cut off at line 100 in the file — cannot fully audit this script from available content. Partial audit shows CONFIGURATION section starts at line 65 but appears complete and matches code patterns observed in related scripts.

### Watchdogs/

**network_watchdog.sh**
- Header cut off at line 100 — incomplete audit. Content shown matches code structure.

**storage_watchdog.sh**
- Header cut off at line 100 — incomplete audit. Content shown matches code structure.

**docker_watchdog.sh**
- Header cut off at line 100 — incomplete audit. Content shown matches code structure.

**resource_watchdog.sh**
- Header cut off at line 100 — incomplete audit. Content shown matches code structure.

**stability_watchdog.sh**
- Header cut off at line 100 — incomplete audit. Content shown matches code structure.

**system_watchdog.sh**
- Minimal header (lines 1-31) documents purpose and configuration. Code matches header for basic orchestrator behavior (lines 90-100 shown). Full audit incomplete due to file length, but visible portion matches.

---

## Summary of Real Discrepancies

**4 substantive issues found:**

1. **smart_long_test.sh** — Documents SMART_TEMP_WARN/SMART_TEMP_CRIT config variables that are never used in code
2. **ramdisk_stop.sh** — Header omits TRANSCODE_STATE_FILE and STATE_DIR variables it uses
3. **ramdisk_setup.sh** — Header omits TRANSCODE_STATE_FILE and STATE_DIR variables it uses
4. **transcode_cleanup.sh** — Header's description of lsof timeout behavior is misleading about what happens on timeout

**1 minor clarity issue:**
- **watchdog_skip_list_manager.sh** — Default behavior with no flags is the same as `--status` but header doesn't clarify this</result>
<usage><subagent_tokens>105604</subagent_tokens><tool_uses>28</tool_uses><duration_ms>37861</duration_ms></usage>
</task-notification>


Four of six groups done. Still waiting on the last one — System_Essentials, Tools, Transcodes, and Watchdogs. Here's what we have so far while we wait:

**Docker_Essentials / Deployment**
- `docker_daily_restart.sh` — `RESTART_VERIFY_WAIT` referenced in log output but never actually used in verification logic
- `downloaders_reset.sh` — header says both "every 15 minutes" and "every 30 minutes" — contradiction

**Fallback / Rsync / Core**
- `fallback.sh` — Tier 4 writeback auto-uses `HOST*_DAILY_SYNC_SHARES` without requiring a separate `FALLBACK_*_WRITEBACK_TIER4` list — undocumented in header

**Media**
- `lidarr_cleanup.sh` — header says Emby scan triggers "after each deletion run", code only triggers when deletions actually occurred
- `playback_aware_sonarr_discovery.sh` — `SONARR_EMBY_LIBRARIES` is required (exits if empty) but only in the FLOW section, not CONFIGURATION
- `radarr_cleanup.sh` — `RADARR_IMPORT_SCAN_TIMEOUT` used in code, missing from CONFIGURATION header
- `sonarr_cleanup.sh` — same, `SONARR_IMPORT_SCAN_TIMEOUT`

**Monitors / Orchestrators**
- `cert_monitor.sh` — `--log` documented as verbose per-domain output, code doesn't change behavior based on it
- `weekly_health_digest.sh` — `DIGEST_SMART_ON_BANDWIDTH` documented as a gate but never used in code — bandwidth always fires
- `zfs_memory_snapshot.sh` — header says output goes to both console and log, but `--dry-run` skips the log write

**Partnership**
- `ssh_setup.sh` — `--local-only` flag implemented and functional but missing from RUNTIME MODES in header


All six groups done. Full consolidated list:

**Header needs updating (behavior is correct, docs are wrong):**
- `downloaders_reset.sh` — "every 15 min" vs "every 30 min" contradiction
- `fallback.sh` — Tier 4 writeback auto-using `DAILY_SYNC_SHARES` undocumented
- `lidarr_cleanup.sh` — "after each deletion run" should be "after runs where deletions occurred"
- `playback_aware_sonarr_discovery.sh` — `SONARR_EMBY_LIBRARIES` required but only in FLOW, not CONFIGURATION
- `radarr_cleanup.sh` / `sonarr_cleanup.sh` — `*_IMPORT_SCAN_TIMEOUT` used but missing from CONFIGURATION
- `ramdisk_setup.sh` / `ramdisk_stop.sh` — `TRANSCODE_STATE_FILE` / `STATE_DIR` used but not documented
- `ssh_setup.sh` — `--local-only` implemented but missing from RUNTIME MODES
- `transcode_cleanup.sh` — lsof timeout description is misleading
- `zfs_memory_snapshot.sh` — "both console and log" isn't true during `--dry-run`

**Dead config in header (documented but never used in code):**
- `weekly_health_digest.sh` — `DIGEST_SMART_ON_BANDWIDTH` documented as a gate, code ignores it
- `smart_long_test.sh` — `SMART_TEMP_WARN` / `SMART_TEMP_CRIT` documented, never referenced in code

**Behavior missing (header promises something the code doesn't do):**
- `cert_monitor.sh` — `--log` documented as verbose per-domain output, code doesn't use it
- `docker_daily_restart.sh` — `RESTART_VERIFY_WAIT` logged as a config value, never applied

For the last two — do you want to implement the missing behavior, or trim the header to match reality?


implement the missing behavior


Reading both files to understand what needs implementing.


Bash

grep -n "ENABLE_LOGGING\|VERBOSE\|log\|RESTART_VERIFY_WAIT\|verify_running\|verify_wait\|VERIFY" /boot/config/plugins/varaverk/Docker_Essentials/docker_daily_restart.sh | head -40

Find verify and logging patterns in docker_daily_restart.sh


98:# docker_daily_restart.sh --log
155:# docker_cmd, verify_running, retry_docker — defined in common.sh
229:log "$ICON_CONTAINERS Containers:    ${DAILY_RESTART_CONTAINERS[*]}"
230:log "$ICON_RETRY      Retries:       $RETRY_COUNT"
231:log "$ICON_GEAR       Config:        sleep=${SLEEP}s delay=${CONTAINER_DELAY}s verify-wait=${RESTART_VERIFY_WAIT}s cmd-timeout=${DOCKER_TIMEOUT}s"
240:log "$ICON_GEAR Restart order: ${ORDERED_RESTART[*]}"
248:    log "━━━ $ICON_CONTAINERS $container ($c_image) ━━━"
259:            log "$ICON_RUNNING $container is running — restarting..."
270:                    if verify_running "$container"; then
271:                        log "$ICON_STARTED $container restarted and running in $(format_duration $(( $(date +%s) - c_start ))) ✅"
287:            log "$ICON_NOT_RUNNING $container is stopped — skipping"
311:    [[ "$ENABLE_LOGGING" == "true" ]] && echo "$PRUNED_OUTPUT" | sed 's/^/  /'
322:[[ ${#RESTARTED[@]} -gt 0 ]] && log "$ICON_STARTED  Restarted: ${RESTARTED[*]}"
323:[[ ${#SKIPPED[@]} -gt 0 ]]   && log "$ICON_NOT_RUNNING Skipped: ${SKIPPED[*]}"


grep -n "ENABLE_LOGGING\|log\b\|domain\|verbose\|per.domain\|VERBOSE" /boot/config/plugins/varaverk/Monitors/cert_monitor.sh | head -40

Find logging patterns in cert_monitor.sh


8:# SSL certificate expiry monitoring for all configured domains. Scheduled weekly
9:# (Sunday 9am). Connects via openssl directly to each domain — not to NPM's API,
12:# Per domain: HEALTHY (> CERT_WARN_DAYS remaining, silent) | WARNING (≤ CERT_WARN_DAYS)
14:# Notifications batched by severity — one message lists all WARNING domains, a
15:# separate message lists all CRITICAL domains. Not one notification per domain.
38:#   Each server monitors its own domains only.
44:#   CERT_TIMEOUT caps each openssl connection attempt. One unreachable domain
45:#   does not block the remaining domains.
57:#       Domains this host monitors. Each domain and subdomain is a separate entry —
69:#       Seconds to wait per domain before declaring FAILED. (default: 10)
76:#     Check all configured domains and notify on WARNING, CRITICAL, or FAILED.
77:#     Silent when all domains are healthy.
80:#     Check all domains and show results. No notifications sent regardless of result.
83:#     Show domain list, warning thresholds, and timeout. Then exit.
85:# cert_monitor.sh --log
86:#     Verbose per-domain output during the run.
127:log "$ICON_GEAR Config: warn=${CERT_WARN_DAYS}d crit=${CERT_CRIT_DAYS}d timeout=${CERT_TIMEOUT}s"
128:log "$ICON_GEAR Domains: ${CERT_MONITOR_DOMAINS[*]}"
142:    echo "$ICON_TIME    Timeout:   ${CERT_TIMEOUT}s per domain"
151:# Connects to domain:443 via openssl, extracts expiry date, calculates days remaining.
159:    local domain="$1"
166:        -connect "${domain}:${port}" \
167:        -servername "$domain" \
171:        error "$ICON_CERT $domain — could not retrieve certificate (unreachable or no TLS)"
179:        error "$ICON_CERT $domain — could not parse expiry date: $expiry_str"
191:        error "$ICON_CERT $domain — CRITICAL: ${days_remaining} days remaining (expires $expiry_display)"
194:        warn "$ICON_CERT $domain — WARNING: ${days_remaining} days remaining (expires $expiry_display)"
197:        log "$ICON_CERT $domain — OK: ${days_remaining} days remaining (expires $expiry_display)"
219:for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
220:    [[ -z "$domain" ]] && continue
221:    check_cert "$domain"
223:    DOMAIN_DAYS["$domain"]="${_CERT_DAYS:-}"
224:    DOMAIN_EXPIRY["$domain"]="${_CERT_EXPIRY:-}"
226:        0) HEALTHY+=("$domain");  DOMAIN_STATUS["$domain"]="OK" ;;
227:        1) WARNING+=("$domain");  DOMAIN_STATUS["$domain"]="WARN" ;;
228:        2) CRITICAL+=("$domain"); DOMAIN_STATUS["$domain"]="CRIT" ;;
229:        3) FAILED+=("$domain");   DOMAIN_STATUS["$domain"]="FAIL" ;;
262:# Per-domain results — only show problems, healthy ones stay in log()
263:for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
264:    [[ -z "$domain" ]] && continue


255	    STATUS=$(timeout "$DOCKER_TIMEOUT" docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null)
256
257	    case "$STATUS" in
258	        true)
259	            log "$ICON_RUNNING $container is running — restarting..."
260
261	            # Wait if this container depends on the last one restarted
262	            check_dependency_delay "$container" "$LAST_RESTARTED"
263
264	            if [[ "$DRY_RUN" == true ]]; then
265	                warn "DRY RUN — would restart $container"
266	                RESTARTED+=("$container")
267	            else
268	                if retry_docker docker restart "$container"; then
269	                    # Verify container stayed running after restart
270	                    if verify_running "$container"; then
271	                        log "$ICON_STARTED $container restarted and running in $(format_duration $(( $(date +%s) - c_start ))) ✅"
272	                        RESTARTED+=("$container")
273	                        LAST_RESTARTED="$container"
274	                    else
275	                        error "$container restarted but crashed immediately"
276	                        notify "$container crashed after restart on $(hostname)" "Docker Daily Restart" "warning"
277	                        FAILED+=("$container")
278	                    fi
279	                else
280	                    error "Failed to restart $container after $RETRY_COUNT attempts"
281	                    notify "$container failed to restart on $(hostname)" "Docker Daily Restart" "warning"
282	                    FAILED+=("$container")
283	                fi
284	            fi
285	            ;;
286	        false)
287	            log "$ICON_NOT_RUNNING $container is stopped — skipping"
288	            SKIPPED+=("$container")
289	            ;;

    STATUS=$(timeout "$DOCKER_TIMEOUT" docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null)

    case "$STATUS" in
        true)
            log "$ICON_RUNNING $container is running — restarting..."

            # Wait if this container depends on the last one restarted
            check_dependency_delay "$container" "$LAST_RESTARTED"

            if [[ "$DRY_RUN" == true ]]; then
                warn "DRY RUN — would restart $container"
                RESTARTED+=("$container")
            else
                if retry_docker docker restart "$container"; then
                    # Verify container stayed running after restart
                    if verify_running "$container"; then
                        log "$ICON_STARTED $container restarted and running in $(format_duration $(( $(date +%s) - c_start ))) ✅"
                        RESTARTED+=("$container")
                        LAST_RESTARTED="$container"
                    else
                        error "$container restarted but crashed immediately"
                        notify "$container crashed after restart on $(hostname)" "Docker Daily Restart" "warning"
                        FAILED+=("$container")
                    fi
                else
                    error "Failed to restart $container after $RETRY_COUNT attempts"
                    notify "$container failed to restart on $(hostname)" "Docker Daily Restart" "warning"
                    FAILED+=("$container")
                fi
            fi
            ;;
        false)
            log "$ICON_NOT_RUNNING $container is stopped — skipping"
            SKIPPED+=("$container")
            ;;


155	#   2 = critical (<= CERT_CRIT_DAYS)
156	#   3 = failed   (could not connect or parse)
157
158	check_cert() {
159	    local domain="$1"
160	    local port="${2:-443}"
161	    _CERT_DAYS=""
162	    _CERT_EXPIRY=""
163
164	    local expiry_str
165	    expiry_str=$(echo | timeout "$CERT_TIMEOUT" openssl s_client \
166	        -connect "${domain}:${port}" \
167	        -servername "$domain" \
168	        2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
169
170	    if [[ -z "$expiry_str" ]]; then
171	        error "$ICON_CERT $domain — could not retrieve certificate (unreachable or no TLS)"
172	        return 3
173	    fi
174
175	    local expiry_epoch
176	    expiry_epoch=$(date -d "$expiry_str" +%s 2>/dev/null)
177
178	    if [[ -z "$expiry_epoch" ]]; then
179	        error "$ICON_CERT $domain — could not parse expiry date: $expiry_str"
180	        return 3
181	    fi
182
183	    local now days_remaining expiry_display
184	    now=$(date +%s)
185	    days_remaining=$(( (expiry_epoch - now) / 86400 ))
186	    expiry_display=$(date -d "$expiry_str" '+%Y-%m-%d' 2>/dev/null)
187	    _CERT_DAYS=$days_remaining
188	    _CERT_EXPIRY=$expiry_display
189
190	    if [[ "$days_remaining" -le "$CERT_CRIT_DAYS" ]]; then
191	        error "$ICON_CERT $domain — CRITICAL: ${days_remaining} days remaining (expires $expiry_display)"
192	        return 2
193	    elif [[ "$days_remaining" -le "$CERT_WARN_DAYS" ]]; then
194	        warn "$ICON_CERT $domain — WARNING: ${days_remaining} days remaining (expires $expiry_display)"
195	        return 1
196	    else
197	        log "$ICON_CERT $domain — OK: ${days_remaining} days remaining (expires $expiry_display)"
198	        return 0
199	    fi
200	}
201
202	# ==============================================================================================
203	# ━━━ Certificate Monitor ━━━
204	# ==============================================================================================

#   2 = critical (<= CERT_CRIT_DAYS)
#   3 = failed   (could not connect or parse)

check_cert() {
    local domain="$1"
    local port="${2:-443}"
    _CERT_DAYS=""
    _CERT_EXPIRY=""

    local expiry_str
    expiry_str=$(echo | timeout "$CERT_TIMEOUT" openssl s_client \
        -connect "${domain}:${port}" \
        -servername "$domain" \
        2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

    if [[ -z "$expiry_str" ]]; then
        error "$ICON_CERT $domain — could not retrieve certificate (unreachable or no TLS)"
        return 3
    fi

    local expiry_epoch
    expiry_epoch=$(date -d "$expiry_str" +%s 2>/dev/null)

    if [[ -z "$expiry_epoch" ]]; then
        error "$ICON_CERT $domain — could not parse expiry date: $expiry_str"
        return 3
    fi

    local now days_remaining expiry_display
    now=$(date +%s)
    days_remaining=$(( (expiry_epoch - now) / 86400 ))
    expiry_display=$(date -d "$expiry_str" '+%Y-%m-%d' 2>/dev/null)
    _CERT_DAYS=$days_remaining
    _CERT_EXPIRY=$expiry_display

    if [[ "$days_remaining" -le "$CERT_CRIT_DAYS" ]]; then
        error "$ICON_CERT $domain — CRITICAL: ${days_remaining} days remaining (expires $expiry_display)"
        return 2
    elif [[ "$days_remaining" -le "$CERT_WARN_DAYS" ]]; then
        warn "$ICON_CERT $domain — WARNING: ${days_remaining} days remaining (expires $expiry_display)"
        return 1
    else
        log "$ICON_CERT $domain — OK: ${days_remaining} days remaining (expires $expiry_display)"
        return 0
    fi
}

# ==============================================================================================
# ━━━ Certificate Monitor ━━━
# ==============================================================================================


202	# ==============================================================================================
203	# ━━━ Certificate Monitor ━━━
204	# ==============================================================================================
205	echo ""
206	echo "━━━ $ICON_CERT Certificate Monitor — $(date '+%Y-%m-%d %H:%M:%S') ━━━"
207	echo "$ICON_HOST $MY_ID ($LOCAL_SERVER_NAME)"
208	info "Warn threshold:  ${CERT_WARN_DAYS} days"
209	info "Crit threshold:  ${CERT_CRIT_DAYS} days"
210	echo ""
211
212	START=$(date +%s)
213	HEALTHY=()
214	WARNING=()
215	CRITICAL=()
216	FAILED=()
217	declare -A DOMAIN_STATUS DOMAIN_DAYS DOMAIN_EXPIRY
218
219	for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
220	    [[ -z "$domain" ]] && continue
221	    check_cert "$domain"
222	    result=$?
223	    DOMAIN_DAYS["$domain"]="${_CERT_DAYS:-}"
224	    DOMAIN_EXPIRY["$domain"]="${_CERT_EXPIRY:-}"
225	    case $result in
226	        0) HEALTHY+=("$domain");  DOMAIN_STATUS["$domain"]="OK" ;;
227	        1) WARNING+=("$domain");  DOMAIN_STATUS["$domain"]="WARN" ;;
228	        2) CRITICAL+=("$domain"); DOMAIN_STATUS["$domain"]="CRIT" ;;
229	        3) FAILED+=("$domain");   DOMAIN_STATUS["$domain"]="FAIL" ;;
230	    esac
231	done
232
233	END=$(date +%s)
234
235	# ── Send notifications — batched per severity ─────────────────────────────────────────────────
236	if [[ "$DRY_RUN" == false ]]; then
237	    [[ ${#CRITICAL[@]} -gt 0 ]] && \
238	        notify "Certificate CRITICAL on $(hostname) — expiring within ${CERT_CRIT_DAYS} days: ${CRITICAL[*]}" \
239	            "Certificate Monitor" "warning"
240	    [[ ${#WARNING[@]} -gt 0 ]] && \
241	        notify "Certificate WARNING on $(hostname) — expiring within ${CERT_WARN_DAYS} days: ${WARNING[*]}" \
242	            "Certificate Monitor" "warning"
243	    [[ ${#FAILED[@]} -gt 0 ]] && \
244	        notify "Certificate check FAILED on $(hostname) — could not reach: ${FAILED[*]}" \
245	            "Certificate Monitor" "warning"
246	fi
247
248	# ==============================================================================================
249	# ━━━ Summary ━━━
250	# ==============================================================================================
251	echo ""
252	echo "━━━━━ $ICON_SUMMARY CERTIFICATE MONITOR SUMMARY ━━━━━"
253	echo "$ICON_HOST    Identity: $MY_ID ($LOCAL_SERVER_NAME)"
254	echo "$ICON_TIME    Duration: $(format_duration $(( END - START )))"
255	echo ""
256	echo "  $ICON_SUCCESS Healthy:  ${#HEALTHY[@]}"
257	[[ ${#WARNING[@]} -gt 0 ]]  && warn "Warning:  ${#WARNING[@]} — renewal recommended"
258	[[ ${#CRITICAL[@]} -gt 0 ]] && echo "$ICON_ERROR   Critical: ${#CRITICAL[@]} — ACTION REQUIRED"
259	[[ ${#FAILED[@]} -gt 0 ]]   && echo "$ICON_ERROR   Failed:   ${#FAILED[@]} — unreachable"
260	echo ""
261
262	# Per-domain results — only show problems, healthy ones stay in log()
263	for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
264	    [[ -z "$domain" ]] && continue
265	    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
266	        OK)   log "  $ICON_SUCCESS $domain — healthy" ;;
267	        WARN) warn "  $ICON_WARN   $domain — warning" ;;
268	        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL" ;;
269	        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
270	    esac
271	done
272	echo ""
273
274	if [[ "$DRY_RUN" == true ]]; then
275	    warn "DRY RUN — no notifications sent"
276	elif [[ ${#CRITICAL[@]} -gt 0 || ${#FAILED[@]} -gt 0 ]]; then
277	    echo "$ICON_ERROR Status: ACTION REQUIRED"
278	elif [[ ${#WARNING[@]} -gt 0 ]]; then
279	    warn "Status: WARNINGS — renewal recommended"
280	else
281	    echo "$ICON_DONE Status: all ${#HEALTHY[@]} certs healthy ✅"

# ==============================================================================================
# ━━━ Certificate Monitor ━━━
# ==============================================================================================
echo ""
echo "━━━ $ICON_CERT Certificate Monitor — $(date '+%Y-%m-%d %H:%M:%S') ━━━"
echo "$ICON_HOST $MY_ID ($LOCAL_SERVER_NAME)"
info "Warn threshold:  ${CERT_WARN_DAYS} days"
info "Crit threshold:  ${CERT_CRIT_DAYS} days"
echo ""

START=$(date +%s)
HEALTHY=()
WARNING=()
CRITICAL=()
FAILED=()
declare -A DOMAIN_STATUS DOMAIN_DAYS DOMAIN_EXPIRY

for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    check_cert "$domain"
    result=$?
    DOMAIN_DAYS["$domain"]="${_CERT_DAYS:-}"
    DOMAIN_EXPIRY["$domain"]="${_CERT_EXPIRY:-}"
    case $result in
        0) HEALTHY+=("$domain");  DOMAIN_STATUS["$domain"]="OK" ;;
        1) WARNING+=("$domain");  DOMAIN_STATUS["$domain"]="WARN" ;;
        2) CRITICAL+=("$domain"); DOMAIN_STATUS["$domain"]="CRIT" ;;
        3) FAILED+=("$domain");   DOMAIN_STATUS["$domain"]="FAIL" ;;
    esac
done

END=$(date +%s)

# ── Send notifications — batched per severity ─────────────────────────────────────────────────
if [[ "$DRY_RUN" == false ]]; then
    [[ ${#CRITICAL[@]} -gt 0 ]] && \
        notify "Certificate CRITICAL on $(hostname) — expiring within ${CERT_CRIT_DAYS} days: ${CRITICAL[*]}" \
            "Certificate Monitor" "warning"
    [[ ${#WARNING[@]} -gt 0 ]] && \
        notify "Certificate WARNING on $(hostname) — expiring within ${CERT_WARN_DAYS} days: ${WARNING[*]}" \
            "Certificate Monitor" "warning"
    [[ ${#FAILED[@]} -gt 0 ]] && \
        notify "Certificate check FAILED on $(hostname) — could not reach: ${FAILED[*]}" \
            "Certificate Monitor" "warning"
fi

# ==============================================================================================
# ━━━ Summary ━━━
# ==============================================================================================
echo ""
echo "━━━━━ $ICON_SUMMARY CERTIFICATE MONITOR SUMMARY ━━━━━"
echo "$ICON_HOST    Identity: $MY_ID ($LOCAL_SERVER_NAME)"
echo "$ICON_TIME    Duration: $(format_duration $(( END - START )))"
echo ""
echo "  $ICON_SUCCESS Healthy:  ${#HEALTHY[@]}"
[[ ${#WARNING[@]} -gt 0 ]]  && warn "Warning:  ${#WARNING[@]} — renewal recommended"
[[ ${#CRITICAL[@]} -gt 0 ]] && echo "$ICON_ERROR   Critical: ${#CRITICAL[@]} — ACTION REQUIRED"
[[ ${#FAILED[@]} -gt 0 ]]   && echo "$ICON_ERROR   Failed:   ${#FAILED[@]} — unreachable"
echo ""

# Per-domain results — only show problems, healthy ones stay in log()
for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
        OK)   log "  $ICON_SUCCESS $domain — healthy" ;;
        WARN) warn "  $ICON_WARN   $domain — warning" ;;
        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL" ;;
        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
    esac
done
echo ""

if [[ "$DRY_RUN" == true ]]; then
    warn "DRY RUN — no notifications sent"
elif [[ ${#CRITICAL[@]} -gt 0 || ${#FAILED[@]} -gt 0 ]]; then
    echo "$ICON_ERROR Status: ACTION REQUIRED"
elif [[ ${#WARNING[@]} -gt 0 ]]; then
    warn "Status: WARNINGS — renewal recommended"
else
    echo "$ICON_DONE Status: all ${#HEALTHY[@]} certs healthy ✅"


85	# ==============================================================================================
86	# RUNTIME MODES
87	# ==============================================================================================
88	#
89	# docker_daily_restart.sh
90	#     Restart all containers in DAILY_RESTART_CONTAINERS
91	#
92	# docker_daily_restart.sh --dry-run
93	#     Preview which containers would be restarted and which would be skipped
94	#
95	# docker_daily_restart.sh --status
96	#     Show configured restart list, container states, and dependency ordering
97	#
98	# docker_daily_restart.sh --log
99	#     Verbose per-container execution output
100	#
101	# ==============================================================================================
102
103	SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
104
105	source "$SCRIPT_DIR/../load_config.sh"
106
107	parse_args "$@"
108
109	# ==============================================================================================
110	# ━━━ Setup ━━━
111	# ==============================================================================================
112	if [[ "$EUID" -ne 0 ]]; then
113	    error "Must be run as root"
114	    exit 1

# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
# docker_daily_restart.sh
#     Restart all containers in DAILY_RESTART_CONTAINERS
#
# docker_daily_restart.sh --dry-run
#     Preview which containers would be restarted and which would be skipped
#
# docker_daily_restart.sh --status
#     Show configured restart list, container states, and dependency ordering
#
# docker_daily_restart.sh --log
#     Verbose per-container execution output
#
# ==============================================================================================

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

source "$SCRIPT_DIR/../load_config.sh"

parse_args "$@"

# ==============================================================================================
# ━━━ Setup ━━━
# ==============================================================================================
if [[ "$EUID" -ne 0 ]]; then
    error "Must be run as root"
    exit 1


Find all wait/delay var definitions in docker_daily_restart.sh


grep -n "RESTART_VERIFY_WAIT" /boot/config/plugins/varaverk/Configurations/master.conf

Check if RESTART_VERIFY_WAIT is defined in master.conf


42:#   CONTAINER_DELAY seconds between dependency restart and dependent restart gives
79:#   SLEEP
82:#   CONTAINER_DELAY
142:    echo "$ICON_TIME       Sleep:     ${SLEEP}s between retries"
208:# If so, waits CONTAINER_DELAY before restarting to allow dependency to settle.
217:        echo "  Waiting ${CONTAINER_DELAY}s — $container depends on $last..."
218:        sleep "$CONTAINER_DELAY"
231:log "$ICON_GEAR       Config:        sleep=${SLEEP}s delay=${CONTAINER_DELAY}s verify-wait=${RESTART_VERIFY_WAIT}s cmd-timeout=${DOCKER_TIMEOUT}s"


(Bash completed with no output)


155	# docker_cmd, verify_running, retry_docker — defined in common.sh
156
157	# Builds a dependency-safe restart order from DAILY_RESTART_CONTAINERS.
158	# Containers that are dependencies of others restart first.
159	# Returns ordered list in ORDERED_RESTART array.
160	build_restart_order() {
161	    ORDERED_RESTART=()
162	    local remaining=("${DAILY_RESTART_CONTAINERS[@]}")
163	    local placed=()
164
165	    # First pass — add dependency containers that appear in our list
166	    for container in "${remaining[@]}"; do
167	        [[ -z "$container" ]] && continue
168	        local is_dependency=false
169	        # Check if this container is a dependency of any other in our list
170	        for dep_string in "${WATCHDOG_DEPENDENCIES[@]}"; do
171	            if [[ "$dep_string" == *"$container"* ]]; then
172	                is_dependency=true
173	                break
174	            fi
175	        done
176	        # Also check associative array format
177	        for dependent in "${!WATCHDOG_DEPENDENCIES[@]}"; do
178	            if [[ "${WATCHDOG_DEPENDENCIES[$dependent]}" == *"$container"* ]]; then
179	                is_dependency=true
180	                break
181	            fi
182	        done
183	        if [[ "$is_dependency" == true ]]; then
184	            # Check not already placed
185	            local already=false
186	            for p in "${placed[@]}"; do [[ "$p" == "$container" ]] && already=true && break; done
187	            if [[ "$already" == false ]]; then
188	                ORDERED_RESTART+=("$container")
189	                placed+=("$container")

# docker_cmd, verify_running, retry_docker — defined in common.sh

# Builds a dependency-safe restart order from DAILY_RESTART_CONTAINERS.
# Containers that are dependencies of others restart first.
# Returns ordered list in ORDERED_RESTART array.
build_restart_order() {
    ORDERED_RESTART=()
    local remaining=("${DAILY_RESTART_CONTAINERS[@]}")
    local placed=()

    # First pass — add dependency containers that appear in our list
    for container in "${remaining[@]}"; do
        [[ -z "$container" ]] && continue
        local is_dependency=false
        # Check if this container is a dependency of any other in our list
        for dep_string in "${WATCHDOG_DEPENDENCIES[@]}"; do
            if [[ "$dep_string" == *"$container"* ]]; then
                is_dependency=true
                break
            fi
        done
        # Also check associative array format
        for dependent in "${!WATCHDOG_DEPENDENCIES[@]}"; do
            if [[ "${WATCHDOG_DEPENDENCIES[$dependent]}" == *"$container"* ]]; then
                is_dependency=true
                break
            fi
        done
        if [[ "$is_dependency" == true ]]; then
            # Check not already placed
            local already=false
            for p in "${placed[@]}"; do [[ "$p" == "$container" ]] && already=true && break; done
            if [[ "$already" == false ]]; then
                ORDERED_RESTART+=("$container")
                placed+=("$container")


215	    local deps="${WATCHDOG_DEPENDENCIES[$container]:-}"
216	    if [[ -n "$deps" ]] && [[ "$deps" == *"$last"* ]]; then
217	        echo "  Waiting ${CONTAINER_DELAY}s — $container depends on $last..."
218	        sleep "$CONTAINER_DELAY"
219	    fi
220	}
221
222
223	# ==============================================================================================
224	# ━━━ Daily Restart ━━━
225	# ==============================================================================================
226	echo ""
227	echo "━━━ $ICON_CONTAINERS Daily Restart — $(date '+%Y-%m-%d %H:%M:%S') ━━━"
228	echo "$ICON_HOST $MY_ID ($LOCAL_SERVER_NAME) — ${#DAILY_RESTART_CONTAINERS[@]} container(s)"
229	log "$ICON_CONTAINERS Containers:    ${DAILY_RESTART_CONTAINERS[*]}"

    local deps="${WATCHDOG_DEPENDENCIES[$container]:-}"
    if [[ -n "$deps" ]] && [[ "$deps" == *"$last"* ]]; then
        echo "  Waiting ${CONTAINER_DELAY}s — $container depends on $last..."
        sleep "$CONTAINER_DELAY"
    fi
}

# ==============================================================================================
# ━━━ Daily Restart ━━━
# ==============================================================================================
echo ""
echo "━━━ $ICON_CONTAINERS Daily Restart — $(date '+%Y-%m-%d %H:%M:%S') ━━━"
echo "$ICON_HOST $MY_ID ($LOCAL_SERVER_NAME) — ${#DAILY_RESTART_CONTAINERS[@]} container(s)"
log "$ICON_CONTAINERS Containers:    ${DAILY_RESTART_CONTAINERS[*]}"


grep -n "RESTART_VERIFY_WAIT\|SLEEP\b\|CONTAINER_DELAY\b\|RETRY_COUNT" /boot/config/plugins/varaverk/Configurations/master.conf | head -20

Find these vars in master.conf


496:    RETRY_COUNT=3                   # retry attempts before giving up
497:    SLEEP=300                       # seconds between retry attempts
500:    CONTAINER_DELAY=5               # seconds before starting delayed containers
561:    declare -A PROFILE_RETRY_COUNT=(
571:    declare -A PROFILE_SLEEP=(
605:    declare -A PROFILE_CONTAINER_DELAY=(
835:    REBOOT_SLEEP=300


`RESTART_VERIFY_WAIT` isn't defined in master.conf at all — it's logged but never set or used. I need to add it to master.conf and apply it before `verify_running`. Now I have everything I need — implementing both:


494	# Appdata shares match profiles by directory basename (lowercased).
495	    BW_LIMIT=12500                  # KB/s — 12500 ≈ 100Mbit
496	    RETRY_COUNT=3                   # retry attempts before giving up
497	    SLEEP=300                       # seconds between retry attempts
498	    CRITICAL_CONTAINER_NAMES=()     # containers stopped on REMOTE before rsync — profiles override
499	    DELAYED_CONTAINERS=()           # containers needing delay before starting — profiles override
500	    CONTAINER_DELAY=5               # seconds before starting delayed containers
501	    EXCLUDE_DIRS=()                 # directories excluded from transfer — profiles override
502
503	# --inplace      writes directly to destination — delta against existing file, better for large media
504	# --partial      keep partial file on interrupted transfer so next run resumes, not re-transfers
505	# --timeout      kill stalled transfers instead of hanging indefinitely

# Appdata shares match profiles by directory basename (lowercased).
    BW_LIMIT=12500                  # KB/s — 12500 ≈ 100Mbit
    RETRY_COUNT=3                   # retry attempts before giving up
    SLEEP=300                       # seconds between retry attempts
    CRITICAL_CONTAINER_NAMES=()     # containers stopped on REMOTE before rsync — profiles override
    DELAYED_CONTAINERS=()           # containers needing delay before starting — profiles override
    CONTAINER_DELAY=5               # seconds before starting delayed containers
    EXCLUDE_DIRS=()                 # directories excluded from transfer — profiles override

# --inplace      writes directly to destination — delta against existing file, better for large media
# --partial      keep partial file on interrupted transfer so next run resumes, not re-transfers
# --timeout      kill stalled transfers instead of hanging indefinitely


65	#   HOST*_DAILY_RESTART_CONTAINERS
66	#       Containers restarted nightly. Also used by docker_update.sh normal mode
67	#       for image pulls — add a container once, it gets both. Aliased by
68	#       detect_hosts() → DAILY_RESTART_CONTAINERS
69	#
70	#   HOST*_WATCHDOG_DEPENDENCIES
71	#       Dependency ordering shared with docker_watchdog.sh. Aliased by
72	#       detect_hosts() → WATCHDOG_DEPENDENCIES
73	#
74	# master.conf
75	#
76	#   RETRY_COUNT
77	#       Retry attempts before giving up on a container
78	#
79	#   SLEEP
80	#       Seconds between retry attempts
81	#
82	#   CONTAINER_DELAY
83	#       Seconds to wait after restarting a dependency before starting its dependents
84	#
85	# ==============================================================================================
86	# RUNTIME MODES
87	# ==============================================================================================
88	#
89	# docker_daily_restart.sh

#   HOST*_DAILY_RESTART_CONTAINERS
#       Containers restarted nightly. Also used by docker_update.sh normal mode
#       for image pulls — add a container once, it gets both. Aliased by
#       detect_hosts() → DAILY_RESTART_CONTAINERS
#
#   HOST*_WATCHDOG_DEPENDENCIES
#       Dependency ordering shared with docker_watchdog.sh. Aliased by
#       detect_hosts() → WATCHDOG_DEPENDENCIES
#
# master.conf
#
#   RETRY_COUNT
#       Retry attempts before giving up on a container
#
#   SLEEP
#       Seconds between retry attempts
#
#   CONTAINER_DELAY
#       Seconds to wait after restarting a dependency before starting its dependents
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
# docker_daily_restart.sh


Now I have the full picture. Making both fixes:


Edit

CONTAINER_DELAY=5               # seconds before starting delayed containers

    CONTAINER_DELAY=5               # seconds before starting delayed containers
    RESTART_VERIFY_WAIT=3           # seconds to wait after restart before checking container is running


The file /boot/config/plugins/varaverk/Configurations/master.conf has been updated successfully. (file state is current in your context — no need to Read it back)

    CONTAINER_DELAY=5               # seconds before starting delayed containers
    RESTART_VERIFY_WAIT=3           # seconds to wait after restart before checking container is running

CRITICAL_CONTAINER_NAMES=()     # containers stopped on REMOTE before rsync — profiles override

DELAYED_CONTAINERS=()           # containers needing delay before starting — profiles override

+    RESTART_VERIFY_WAIT=3           # seconds to wait after restart before checking container is running

EXCLUDE_DIRS=()                 # directories excluded from transfer — profiles override

# --inplace      writes directly to destination — delta against existing file, better for large media


   CONTAINER_DELAY
#       Seconds to wait after restarting a dependency before starting its dependents
#

   CONTAINER_DELAY
#       Seconds to wait after restarting a dependency before starting its dependents
#
#   RESTART_VERIFY_WAIT
#       Seconds to wait after docker restart before checking the container is running.
#       Gives the process time to initialise before verify_running samples the state.
#       (default: 3)
#


The file /boot/config/plugins/varaverk/Docker_Essentials/docker_daily_restart.sh has been updated successfully. (file state is current in your context — no need to Read it back)

   CONTAINER_DELAY
#       Seconds to wait after restarting a dependency before starting its dependents
#
#   RESTART_VERIFY_WAIT
#       Seconds to wait after docker restart before checking the container is running.
#       Gives the process time to initialise before verify_running samples the state.
#       (default: 3)
#

+#       Seconds to wait after docker restart before checking the container is running.

+#       Gives the process time to initialise before verify_running samples the state.


                if retry_docker docker restart "$container"; then
                    # Verify container stayed running after restart
                    if verify_running "$container"; then

                if retry_docker docker restart "$container"; then
                    [[ "${RESTART_VERIFY_WAIT:-3}" -gt 0 ]] && sleep "${RESTART_VERIFY_WAIT:-3}"
                    if verify_running "$container"; then


                if retry_docker docker restart "$container"; then
                    # Verify container stayed running after restart
                    if verify_running "$container"; then

                if retry_docker docker restart "$container"; then
                    [[ "${RESTART_VERIFY_WAIT:-3}" -gt 0 ]] && sleep "${RESTART_VERIFY_WAIT:-3}"
                    if verify_running "$container"; then

-                    # Verify container stayed running after restart

+                    [[ "${RESTART_VERIFY_WAIT:-3}" -gt 0 ]] && sleep "${RESTART_VERIFY_WAIT:-3}"

log "$ICON_STARTED $container restarted and running in $(format_duration $(( $(date +%s) - c_start ))) ✅"


Now fix `cert_monitor.sh` — the per-domain summary loop needs to include expiry details when `--log` is active, and WARN/CRIT should always show their days remaining since that's actionable:


# Per-domain results — only show problems, healthy ones stay in log()
for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
        OK)   log "  $ICON_SUCCESS $domain — healthy" ;;
        WARN) warn "  $ICON_WARN   $domain — warning" ;;
        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL" ;;
        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
    esac
done

# Per-domain results — problems always shown with days remaining; healthy only with --log
for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    local _days="${DOMAIN_DAYS[$domain]:-?}" _exp="${DOMAIN_EXPIRY[$domain]:-unknown}"
    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
        OK)   log  "  $ICON_SUCCESS $domain — healthy (${_days}d, expires ${_exp})" ;;
        WARN) warn "  $ICON_WARN   $domain — warning (${_days}d, expires ${_exp})" ;;
        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL (${_days}d, expires ${_exp})" ;;
        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
    esac
done


The file /boot/config/plugins/varaverk/Monitors/cert_monitor.sh has been updated successfully. (file state is current in your context — no need to Read it back)

# Per-domain results — only show problems, healthy ones stay in log()
for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
        OK)   log "  $ICON_SUCCESS $domain — healthy" ;;
        WARN) warn "  $ICON_WARN   $domain — warning" ;;
        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL" ;;
        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
    esac
done

# Per-domain results — problems always shown with days remaining; healthy only with --log
for domain in "${CERT_MONITOR_DOMAINS[@]}"; do
    [[ -z "$domain" ]] && continue
    local _days="${DOMAIN_DAYS[$domain]:-?}" _exp="${DOMAIN_EXPIRY[$domain]:-unknown}"
    case "${DOMAIN_STATUS[$domain]:-UNKN}" in
        OK)   log  "  $ICON_SUCCESS $domain — healthy (${_days}d, expires ${_exp})" ;;
        WARN) warn "  $ICON_WARN   $domain — warning (${_days}d, expires ${_exp})" ;;
        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL (${_days}d, expires ${_exp})" ;;
        FAIL) echo "  $ICON_ERROR  $domain — unreachable" ;;
    esac
done

[[ ${#FAILED[@]} -gt 0 ]]   && echo "$ICON_ERROR   Failed:   ${#FAILED[@]} — unreachable"

-# Per-domain results — only show problems, healthy ones stay in log()

+# Per-domain results — problems always shown with days remaining; healthy only with --log

+    local _days="${DOMAIN_DAYS[$domain]:-?}" _exp="${DOMAIN_EXPIRY[$domain]:-unknown}"

-        OK)   log "  $ICON_SUCCESS $domain — healthy" ;;

-        WARN) warn "  $ICON_WARN   $domain — warning" ;;

-        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL" ;;

+        OK)   log  "  $ICON_SUCCESS $domain — healthy (${_days}d, expires ${_exp})" ;;

+        WARN) warn "  $ICON_WARN   $domain — warning (${_days}d, expires ${_exp})" ;;

+        CRIT) echo "  $ICON_ERROR  $domain — CRITICAL (${_days}d, expires ${_exp})" ;;


Now tackle all the header-only fixes. I'll do them in parallel by file:


1	#!/bin/bash
2	# ==============================================================================================
3	# ================================= Downloaders Reset ==========================================
4	# ==============================================================================================
5	#
6	# PURPOSE
7	# ─────────────────────────────────────────────────────────────────────────────
8	# Maintenance reset for all download clients on this server. Clears accumulated
9	# state that download clients generate but never clean up themselves — stuck
10	# searches, dead transfers, failed imports, stale queue entries, completed history.
11	#
12	# Called every 30 minutes by critical_sync_maintenance.sh via
13	# CRITICAL_MAINTENANCE_SCRIPTS. Can also be run manually for ad hoc cleanup.
14	# If a downloader is not configured for this host, that section skips cleanly.
15	#
16	# ==============================================================================================
17	# OPERATIONAL MODEL
18	# ==============================================================================================
19	#
20	# slskd

#!/bin/bash
# ==============================================================================================
# ================================= Downloaders Reset ==========================================
# ==============================================================================================
#
# PURPOSE
# ─────────────────────────────────────────────────────────────────────────────
# Maintenance reset for all download clients on this server. Clears accumulated
# state that download clients generate but never clean up themselves — stuck
# searches, dead transfers, failed imports, stale queue entries, completed history.
#
# Called every 30 minutes by critical_sync_maintenance.sh via
# CRITICAL_MAINTENANCE_SCRIPTS. Can also be run manually for ad hoc cleanup.
# If a downloader is not configured for this host, that section skips cleanly.
#
# ==============================================================================================
# OPERATIONAL MODEL
# ==============================================================================================
#
# slskd


145	#
146	#   HOST*_DDNS_CONTAINERS
147	#       DDNS containers this host manages — stopped on internet loss, started
148	#       as the last step of handback
149	#
150	#   FALLBACK_HOST*_STOP_ON_NO_NET
151	#       Containers stopped when this host loses internet
152	#
153	#   FALLBACK_HOST*_COVERS_HOST*_TIER1–4
154	#       Containers this host starts for the remote when remote is down, by tier.
155	#       Variable pattern: FALLBACK_${MY_ID}_COVERS_${REMOTE_ID}_TIER${N}
156	#
157	#   HOST*_TIER2_DELAY / TIER3_DELAY / TIER4_DELAY
158	#       Minutes after FALLBACK entry before activating each tier.
159	#       References the remote host's ID: HOST1_TIER2_DELAY for HOST1 outage.
160	#       (defaults: 240 / 720 / 1440)
161	#
162	#   HOST*_TIER1_WRITEBACK_DELAY
163	#       Minimum outage minutes before Tier 1 writeback runs. Skip for short
164	#       outages where primary state is cleaner. (default: 60)
165	#
166	#   FALLBACK_HOST*_WRITEBACK_TIER1–4
167	#       Paths rsynced back to remote on handback, per tier.
168	#       Tier 4 auto-uses HOST*_DAILY_SYNC_SHARES — no separate list needed.
169	#       Variable pattern: FALLBACK_${REMOTE_ID}_WRITEBACK_TIER${N}
170	#
171	# master.conf
172	#
173	#   FALLBACK_ENABLED
174	#       false = exit cleanly (e.g. remote server being rebuilt). (default: false)

#
#   HOST*_DDNS_CONTAINERS
#       DDNS containers this host manages — stopped on internet loss, started
#       as the last step of handback
#
#   FALLBACK_HOST*_STOP_ON_NO_NET
#       Containers stopped when this host loses internet
#
#   FALLBACK_HOST*_COVERS_HOST*_TIER1–4
#       Containers this host starts for the remote when remote is down, by tier.
#       Variable pattern: FALLBACK_${MY_ID}_COVERS_${REMOTE_ID}_TIER${N}
#
#   HOST*_TIER2_DELAY / TIER3_DELAY / TIER4_DELAY
#       Minutes after FALLBACK entry before activating each tier.
#       References the remote host's ID: HOST1_TIER2_DELAY for HOST1 outage.
#       (defaults: 240 / 720 / 1440)
#
#   HOST*_TIER1_WRITEBACK_DELAY
#       Minimum outage minutes before Tier 1 writeback runs. Skip for short
#       outages where primary state is cleaner. (default: 60)
#
#   FALLBACK_HOST*_WRITEBACK_TIER1–4
#       Paths rsynced back to remote on handback, per tier.
#       Tier 4 auto-uses HOST*_DAILY_SYNC_SHARES — no separate list needed.
#       Variable pattern: FALLBACK_${REMOTE_ID}_WRITEBACK_TIER${N}
#
# master.conf
#
#   FALLBACK_ENABLED
#       false = exit cleanly (e.g. remote server being rebuilt). (default: false)


1	#!/bin/bash
2	# ==============================================================================================
3	# ================================= Lidarr Cleanup =============================================
4	# ==============================================================================================
5	#
6	# PURPOSE
7	# ─────────────────────────────────────────────────────────────────────────────
8	# Delete orphaned music files not tracked by Lidarr. Queries the API for all
9	# tracked file paths, walks the library on disk, and removes anything untracked
10	# that is old enough to be past the import window. Triggers an Emby library
11	# clean after each deletion run so ghost entries disappear immediately.
12	#
13	# ==============================================================================================
14	# OPERATIONAL MODEL
15	# ==============================================================================================
16	#
17	# Every file encountered on disk is classified into one of five categories:
18	#
19	#   TRACKED   — Lidarr API knows this exact path → leave it alone
20	#   PROTECTED — matches LIDARR_PROTECTED_PATTERNS → never delete

#!/bin/bash
# ==============================================================================================
# ================================= Lidarr Cleanup =============================================
# ==============================================================================================
#
# PURPOSE
# ─────────────────────────────────────────────────────────────────────────────
# Delete orphaned music files not tracked by Lidarr. Queries the API for all
# tracked file paths, walks the library on disk, and removes anything untracked
# that is old enough to be past the import window. Triggers an Emby library
# clean after each deletion run so ghost entries disappear immediately.
#
# ==============================================================================================
# OPERATIONAL MODEL
# ==============================================================================================
#
# Every file encountered on disk is classified into one of five categories:
#
#   TRACKED   — Lidarr API knows this exact path → leave it alone
#   PROTECTED — matches LIDARR_PROTECTED_PATTERNS → never delete


Good — `fallback.sh` line 168 already has the Tier 4 documentation. That one's already correct. Let me check downloaders_reset.sh line 80:


75	#   all HOST*_SLSKD_*, HOST*_SABNZBD_*, and HOST*_QBIT_* vars to the correct
76	#   host's values. Downloaders not configured on this host skip automatically.
77	#
78	# Lock Acquisition
79	#   acquire_lock "wait" — waits for previous run to finish since this runs every
80	#   15 minutes and prior execution may still be completing.
81	#
82	# ==============================================================================================
83	# CONFIGURATION
84	# ==============================================================================================

#   all HOST*_SLSKD_*, HOST*_SABNZBD_*, and HOST*_QBIT_* vars to the correct
#   host's values. Downloaders not configured on this host skip automatically.
#
# Lock Acquisition
#   acquire_lock "wait" — waits for previous run to finish since this runs every
#   15 minutes and prior execution may still be completing.
#
# ==============================================================================================
# CONFIGURATION
# ==============================================================================================


  acquire_lock "wait" — waits for previous run to finish since this runs every
#   15 minutes and prior execution may still be completing.

  acquire_lock "wait" — waits for previous run to finish since this runs every
#   30 minutes and prior execution may still be completing.


The file /boot/config/plugins/varaverk/Docker_Essentials/downloaders_reset.sh has been updated successfully. (file state is current in your context — no need to Read it back)

  acquire_lock "wait" — waits for previous run to finish since this runs every
#   15 minutes and prior execution may still be completing.

  acquire_lock "wait" — waits for previous run to finish since this runs every
#   30 minutes and prior execution may still be completing.

#   acquire_lock "wait" — waits for previous run to finish since this runs every

-#   15 minutes and prior execution may still be completing.

+#   30 minutes and prior execution may still be completing.


# Delete orphaned music files not tracked by Lidarr. Queries the API for all
# tracked file paths, walks the library on disk, and removes anything untracked
# that is old enough to be past the import window. Triggers an Emby library
# clean after each deletion run so ghost entries disappear immediately.

# Delete orphaned music files not tracked by Lidarr. Queries the API for all
# tracked file paths, walks the library on disk, and removes anything untracked
# that is old enough to be past the import window. Triggers an Emby library
# clean after runs where files were deleted so ghost entries disappear immediately.


The file /boot/config/plugins/varaverk/Media/lidarr_cleanup.sh has been updated successfully. (file state is current in your context — no need to Read it back)

# Delete orphaned music files not tracked by Lidarr. Queries the API for all
# tracked file paths, walks the library on disk, and removes anything untracked
# that is old enough to be past the import window. Triggers an Emby library
# clean after each deletion run so ghost entries disappear immediately.

# Delete orphaned music files not tracked by Lidarr. Queries the API for all
# tracked file paths, walks the library on disk, and removes anything untracked
# that is old enough to be past the import window. Triggers an Emby library
# clean after runs where files were deleted so ghost entries disappear immediately.

-# clean after each deletion run so ghost entries disappear immediately.

+# clean after runs where files were deleted so ghost entries disappear immediately.


Now the remaining fixes — read the CONFIGURATION sections that need updating:


Bash

grep -n "CONFIGURATION\|SONARR_EMBY_LIBRARIES\|required\|host\*\.conf\|master\.conf" /boot/config/plugins/varaverk/Media/playback_aware_sonarr_discovery.sh | head -20

Find CONFIGURATION section in playback_aware_sonarr_discovery.sh


grep -n "IMPORT_SCAN_TIMEOUT\|CONFIGURATION\|master\.conf" /boot/config/plugins/varaverk/Media/radarr_cleanup.sh | head -15

Find CONFIGURATION section in radarr_cleanup.sh


23:#   1. Fetch all Series from Emby SONARR_EMBY_LIBRARIES — build TMDB+TVDB index
64:#   TMDB API key — required for Stage 2 recommendations and external_ids lookup
65:#   Configure HOST*_TMDB_API_KEY in host*.conf
69:# CONFIGURATION (master.conf)
81:#   SONARR_EMBY_LIBRARIES             — Emby library names to draw seeds from
93:# Recommended schedule: weekly (WEEKLY_MAINTENANCE_SCRIPTS in master.conf)
148:    error "jq not installed — required for API JSON parsing"
153:    error "EMBY_URL / EMBY_API_KEY not configured — check host*.conf"
158:    error "SONARR_URL / SONARR_API_KEY not configured — check host*.conf"
163:    error "TMDB_API_KEY not configured — required for discovery"
165:    error "Configure HOST*_TMDB_API_KEY in host*.conf"
169:if [[ "${#SONARR_EMBY_LIBRARIES[@]}" -eq 0 ]]; then
170:    error "SONARR_EMBY_LIBRARIES not configured — check master.conf"
209:    echo "$ICON_GEAR    Seed libs:      ${SONARR_EMBY_LIBRARIES[*]}"
356:for lib_name in "${SONARR_EMBY_LIBRARIES[@]}"; do


40:#   3. API version matches RADARR_VERSION_MAJOR in master.conf
53:# CONFIGURATION
62:# master.conf
69:#   RADARR_IMPORT_SCAN_TIMEOUT — seconds to wait for pre-flight import scan (default 600)
335:    POLL_TIMEOUT=${RADARR_IMPORT_SCAN_TIMEOUT:-600}


53	# CONFIGURATION
54	# ==============================================================================================
55	#
56	# host*.conf
57	#
58	#   HOST*_RADARR_URL / HOST*_RADARR_API_KEY / HOST*_RADARR_MOVIES_ROOT
59	#   HOST*_RADARR_PATH_MAP — container path → host path translation
60	#   All aliased by detect_hosts() — script uses unprefixed names
61	#
62	# master.conf
63	#
64	#   RADARR_ORPHAN_AGE          — days before untracked file eligible for deletion
65	#   RADARR_MAX_DELETE_GB       — require --i-know-what-im-doing above this
66	#   RADARR_EXTENSIONS          — video file extensions for orphan classification
67	#   RADARR_PROTECTED_PATTERNS  — file patterns never deleted
68	#   RADARR_VERSION_MAJOR       — expected Radarr major version for API safety check
69	#   RADARR_IMPORT_SCAN_TIMEOUT — seconds to wait for pre-flight import scan (default 600)
70	#   ARR_CLEANUP_STATS          — stats file path (read by coffee report)
71	#
72	# ==============================================================================================
73	# RUNTIME MODES
74	# ==============================================================================================
75	#
76	#   radarr_cleanup.sh                                           — normal run
77	#   radarr_cleanup.sh --dry-run                                 — preview, no deletions

# CONFIGURATION
# ==============================================================================================
#
# host*.conf
#
#   HOST*_RADARR_URL / HOST*_RADARR_API_KEY / HOST*_RADARR_MOVIES_ROOT
#   HOST*_RADARR_PATH_MAP — container path → host path translation
#   All aliased by detect_hosts() — script uses unprefixed names
#
# master.conf
#
#   RADARR_ORPHAN_AGE          — days before untracked file eligible for deletion
#   RADARR_MAX_DELETE_GB       — require --i-know-what-im-doing above this
#   RADARR_EXTENSIONS          — video file extensions for orphan classification
#   RADARR_PROTECTED_PATTERNS  — file patterns never deleted
#   RADARR_VERSION_MAJOR       — expected Radarr major version for API safety check
#   RADARR_IMPORT_SCAN_TIMEOUT — seconds to wait for pre-flight import scan (default 600)
#   ARR_CLEANUP_STATS          — stats file path (read by coffee report)
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
#   radarr_cleanup.sh                                           — normal run
#   radarr_cleanup.sh --dry-run                                 — preview, no deletions


69	# CONFIGURATION (master.conf)
70	# ==============================================================================================
71	#
72	#   SONARR_DISCOVERY_THRESHOLD        — minimum score to add a candidate (default: 52)
73	#   SONARR_DISCOVERY_LOOKBACK_DAYS    — Emby watch history window in days (default: 14)
74	#   SONARR_DISCOVERY_MAX_SEEDS        — max seed series from Stage 1 (default: 5)
75	#   SONARR_DISCOVERY_MAX_ADDS         — max shows to add per run (default: 3)
76	#   SONARR_DISCOVERY_MIN_VOTE_COUNT   — min TMDB votes for a candidate (default: 50)
77	#   SONARR_DISCOVERY_MIN_RATING       — min TMDB vote_average × 10 (default: 65 = 6.5/10)
78	#   SONARR_DISCOVERY_REJECT_COOLDOWN  — days before re-evaluating a rejected show (default: 60)
79	#   SONARR_DISCOVERY_USER_EPISODE_CAP — max episodes per user in seed scoring (default: 8)
80	#   SONARR_DISCOVERY_MONITOR_MODE     — Sonarr monitor mode on add: "all" or "future" (default: "all")
81	#   SONARR_EMBY_LIBRARIES             — Emby library names to draw seeds from
82	#   SONARR_DISCOVERY_HISTORY          — history/state file path
83	#
84	# ==============================================================================================
85	# RUNTIME MODES
86	# ==============================================================================================
87	#
88	#   playback_aware_sonarr_discovery.sh            — normal run

# CONFIGURATION (master.conf)
# ==============================================================================================
#
#   SONARR_DISCOVERY_THRESHOLD        — minimum score to add a candidate (default: 52)
#   SONARR_DISCOVERY_LOOKBACK_DAYS    — Emby watch history window in days (default: 14)
#   SONARR_DISCOVERY_MAX_SEEDS        — max seed series from Stage 1 (default: 5)
#   SONARR_DISCOVERY_MAX_ADDS         — max shows to add per run (default: 3)
#   SONARR_DISCOVERY_MIN_VOTE_COUNT   — min TMDB votes for a candidate (default: 50)
#   SONARR_DISCOVERY_MIN_RATING       — min TMDB vote_average × 10 (default: 65 = 6.5/10)
#   SONARR_DISCOVERY_REJECT_COOLDOWN  — days before re-evaluating a rejected show (default: 60)
#   SONARR_DISCOVERY_USER_EPISODE_CAP — max episodes per user in seed scoring (default: 8)
#   SONARR_DISCOVERY_MONITOR_MODE     — Sonarr monitor mode on add: "all" or "future" (default: "all")
#   SONARR_EMBY_LIBRARIES             — Emby library names to draw seeds from
#   SONARR_DISCOVERY_HISTORY          — history/state file path
#
# ==============================================================================================
# RUNTIME MODES
# ==============================================================================================
#
#   playback_aware_sonarr_discovery.sh            — normal run


Both are already documented — the agents were reading truncated files. `radarr_cleanup.sh` has `RADARR_IMPORT_SCAN_TIMEOUT` at line 69, `playback_aware_sonarr_discovery.sh` has `SONARR_EMBY_LIBRARIES` at line 81. The "required" nature isn't called out, but that's minor. Let me check the remaining real ones — `ramdisk_stop.sh`, `ramdisk_setup.sh`, `transcode_cleanup.sh`, `ssh_setup.sh`, and the dead-config fixes:


grep -n "TRANSCODE_STATE_FILE\|STATE_DIR\|CONFIGURATION\|state" /boot/config/plugins/varaverk/Tools/ramdisk_stop.sh | head -20

Find state file references in ramdisk_stop.sh


10:# then unmounts the tmpfs and updates the state file.
26:#   5. Update /tmp/transcode_state.db → current_target=TRANSCODE_SSD
54:# CONFIGURATION
69:#   /tmp/transcode_state.db    — updated to current_target=TRANSCODE_SSD after stop.
77:#     Stop the ramdisk: redirect symlink → SSD, unmount, update state.
83:#     Show current mount state, symlink target, active files on ramdisk. Exit.
109:STATE_FILE="${TRANSCODE_STATE_FILE:-${STATE_DIR:-/tmp}/transcode_state.db}"
307:    warn "Skipping state file update — stop had errors"


grep -n "TRANSCODE_STATE_FILE\|STATE_DIR\|CONFIGURATION\|state" /boot/config/plugins/varaverk/Transcodes/ramdisk_setup.sh | head -20

Find state file references in ramdisk_setup.sh


grep -n "local-only\|RUNTIME MODES\|local_only" /boot/config/plugins/varaverk/Partnership/ssh_setup.sh | head -15

Find --local-only in ssh_setup.sh


12:# on boot, ensuring a clean state regardless of what state it was in before
22:#   3. TRANSCODE_LINK — symlink reset to RAMDISK_PATH (clean state at every boot)
29:# Initialises /tmp/transcode_state.db with current target and flip counters.
30:# /tmp resets on reboot — correct, transcode state should not persist across boots.
53:# CONFIGURATION
85:#   /tmp/transcode_state.db    — current symlink target + flip count tracking
99:#     Show current ramdisk mount state, symlink target, and SSD directory state.
326:    STATE_FILE="${TRANSCODE_STATE_FILE:-${STATE_DIR:-/tmp}/transcode_state.db}"


56:        --local-only) LOCAL_ONLY=true ;;

56:        --local-only) LOCAL_ONLY=true ;;


54	# CONFIGURATION
55	# ==============================================================================================
56	#
57	# host*.conf
58	#   HOST*_TRANSCODE_SSD     SSD fallback directory — redirect target during stop.
59	#                           Aliased by detect_hosts() → TRANSCODE_SSD.
60	#
61	# master.conf
62	#   TRANSCODE_LINK          Symlink Emby uses. Must match Emby's transcode path setting.
63	#   RAMDISK_PATH            tmpfs mount point.
64	#
65	# ==============================================================================================
66	# STATE FILES
67	# ==============================================================================================
68	#
69	#   /tmp/transcode_state.db    — updated to current_target=TRANSCODE_SSD after stop.
70	#                                transcode_manager.sh reads this on its next cycle.
71	#
72	# ==============================================================================================
73	# RUNTIME MODES

# CONFIGURATION
# ==============================================================================================
#
# host*.conf
#   HOST*_TRANSCODE_SSD     SSD fallback directory — redirect target during stop.
#                           Aliased by detect_hosts() → TRANSCODE_SSD.
#
# master.conf
#   TRANSCODE_LINK          Symlink Emby uses. Must match Emby's transcode path setting.
#   RAMDISK_PATH            tmpfs mount point.
#
# ==============================================================================================
# STATE FILES
# ==============================================================================================
#
#   /tmp/transcode_state.db    — updated to current_target=TRANSCODE_SSD after stop.
#                                transcode_manager.sh reads this on its next cycle.
#
# ==============================================================================================
# RUNTIME MODES


53	# CONFIGURATION
54	# ==============================================================================================
55	#
56	# host*.conf
57	#
58	#   HOST*_RAMDISK_SIZE
59	#       tmpfs ceiling (e.g. 10G). Must change together with WARN_GB and LOW_GB.
60	#       Aliased by detect_hosts() → RAMDISK_SIZE.
61	#
62	#   HOST*_RAMDISK_WARN_GB
63	#       Usage level at which transcode_manager.sh flips symlink to SSD.
64	#
65	#   HOST*_RAMDISK_LOW_GB
66	#       Usage level at which transcode_manager.sh flips back to ramdisk.
67	#
68	#   HOST*_TRANSCODE_SSD
69	#       SSD fallback directory path.
70	#       Aliased by detect_hosts() → TRANSCODE_SSD.
71	#
72	# master.conf

# CONFIGURATION
# ==============================================================================================
#
# host*.conf
#
#   HOST*_RAMDISK_SIZE
#       tmpfs ceiling (e.g. 10G). Must change together with WARN_GB and LOW_GB.
#       Aliased by detect_hosts() → RAMDISK_SIZE.
#
#   HOST*_RAMDISK_WARN_GB
#       Usage level at which transcode_manager.sh flips symlink to SSD.
#
#   HOST*_RAMDISK_LOW_GB
#       Usage level at which transcode_manager.sh flips back to ramdisk.
#
#   HOST*_TRANSCODE_SSD
#       SSD fallback directory path.
#       Aliased by detect_hosts() → TRANSCODE_SSD.
#
# master.conf


28	# ── CONFIGURATION (master.conf) ───────────────────────────────────────────────────────────────
29	#   SSH_MAX_STRIKES       — consecutive failures before notifying (default 5)
30	#   SSH_STRIKE_RESET_HRS  — hours since last failure before counter resets (default 24)
31	#
32	# ── USAGE ─────────────────────────────────────────────────────────────────────────────────────
33	#   Partnership/ssh_setup.sh                — initial setup (idempotent)
34	#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
35	#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
36	#   Partnership/ssh_setup.sh --status       — show key and connectivity state
37	#   Any mode supports --dry-run and --log
38	# ==============================================================================================
39
40	SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
41	SCRIPTS_ROOT="$SCRIPT_DIR/.."
42
43	source "$SCRIPTS_ROOT/load_config.sh"
44
45	# ── Parse --force before parse_args ───────────────────────────────────────────────────────────
46	MODE="setup"
47	FORCE=false

# ── CONFIGURATION (master.conf) ───────────────────────────────────────────────────────────────
#   SSH_MAX_STRIKES       — consecutive failures before notifying (default 5)
#   SSH_STRIKE_RESET_HRS  — hours since last failure before counter resets (default 24)
#
# ── USAGE ─────────────────────────────────────────────────────────────────────────────────────
#   Partnership/ssh_setup.sh                — initial setup (idempotent)
#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
#   Partnership/ssh_setup.sh --status       — show key and connectivity state
#   Any mode supports --dry-run and --log
# ==============================================================================================

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SCRIPTS_ROOT="$SCRIPT_DIR/.."

source "$SCRIPTS_ROOT/load_config.sh"

# ── Parse --force before parse_args ───────────────────────────────────────────────────────────
MODE="setup"
FORCE=false


Edit

# master.conf
#   TRANSCODE_LINK          Symlink Emby uses. Must match Emby's transcode path setting.
#   RAMDISK_PATH            tmpfs mount point.

# master.conf
#   TRANSCODE_LINK          Symlink Emby uses. Must match Emby's transcode path setting.
#   RAMDISK_PATH            tmpfs mount point.
#   TRANSCODE_STATE_FILE    Override state file path (default: ${STATE_DIR}/transcode_state.db).


The file /boot/config/plugins/varaverk/Tools/ramdisk_stop.sh has been updated successfully. (file state is current in your context — no need to Read it back)

# master.conf
#   TRANSCODE_LINK          Symlink Emby uses. Must match Emby's transcode path setting.
#   RAMDISK_PATH            tmpfs mount point.
#   TRANSCODE_STATE_FILE    Override state file path (default: ${STATE_DIR}/transcode_state.db).

#   RAMDISK_PATH            tmpfs mount point.

+#   TRANSCODE_STATE_FILE    Override state file path (default: ${STATE_DIR}/transcode_state.db).


72	# master.conf
73	#
74	#   TRANSCODE_LINK
75	#       Symlink path Emby uses as its transcode directory. Must match the path
76	#       configured in Emby's transcoding settings.
77	#
78	#   TRANSCODE_CHMOD / TRANSCODE_OWNER
79	#       Permissions applied to both ramdisk and SSD directories. (default: 755 / nobody:users)
80	#
81	# ==============================================================================================
82	# STATE FILES
83	# ==============================================================================================
84	#
85	#   /tmp/transcode_state.db    — current symlink target + flip count tracking
86	#                                Lives in /tmp (ephemeral — resets on reboot correctly)

# master.conf
#
#   TRANSCODE_LINK
#       Symlink path Emby uses as its transcode directory. Must match the path
#       configured in Emby's transcoding settings.
#
#   TRANSCODE_CHMOD / TRANSCODE_OWNER
#       Permissions applied to both ramdisk and SSD directories. (default: 755 / nobody:users)
#
# ==============================================================================================
# STATE FILES
# ==============================================================================================
#
#   /tmp/transcode_state.db    — current symlink target + flip count tracking
#                                Lives in /tmp (ephemeral — resets on reboot correctly)


#   TRANSCODE_CHMOD / TRANSCODE_OWNER
#       Permissions applied to both ramdisk and SSD directories. (default: 755 / nobody:users)
#
#   TRANSCODE_STATE_FILE
#       Override state file path. (default: ${STATE_DIR}/transcode_state.db)
#
# ==============================================================================================
# STATE FILES
# ==============================================================================================
#
#   TRANSCODE_STATE_FILE (default: ${STATE_DIR}/transcode_state.db)
#       Current symlink target + flip count tracking. Lives in STATE_DIR
#       (ephemeral on Unraid — resets on reboot correctly).


The file /boot/config/plugins/varaverk/Transcodes/ramdisk_setup.sh has been updated successfully. (file state is current in your context — no need to Read it back)

#   TRANSCODE_CHMOD / TRANSCODE_OWNER
#       Permissions applied to both ramdisk and SSD directories. (default: 755 / nobody:users)
#
#   TRANSCODE_STATE_FILE
#       Override state file path. (default: ${STATE_DIR}/transcode_state.db)
#
# ==============================================================================================
# STATE FILES
# ==============================================================================================
#
#   TRANSCODE_STATE_FILE (default: ${STATE_DIR}/transcode_state.db)
#       Current symlink target + flip count tracking. Lives in STATE_DIR
#       (ephemeral on Unraid — resets on reboot correctly).

+#       Override state file path. (default: ${STATE_DIR}/transcode_state.db)

-#   /tmp/transcode_state.db    — current symlink target + flip count tracking

-#                                Lives in /tmp (ephemeral — resets on reboot correctly)

+#   TRANSCODE_STATE_FILE (default: ${STATE_DIR}/transcode_state.db)

+#       Current symlink target + flip count tracking. Lives in STATE_DIR

+#       (ephemeral on Unraid — resets on reboot correctly).


#   Partnership/ssh_setup.sh                — initial setup (idempotent)
#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
#   Partnership/ssh_setup.sh --status       — show key and connectivity state
#   Any mode supports --dry-run and --log

#   Partnership/ssh_setup.sh                — initial setup (idempotent)
#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
#   Partnership/ssh_setup.sh --status       — show key and connectivity state
#   Partnership/ssh_setup.sh --local-only   — generate key locally, skip remote copy
#   Any mode supports --dry-run and --log


The file /boot/config/plugins/varaverk/Partnership/ssh_setup.sh has been updated successfully. (file state is current in your context — no need to Read it back)

#   Partnership/ssh_setup.sh                — initial setup (idempotent)
#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
#   Partnership/ssh_setup.sh --status       — show key and connectivity state
#   Any mode supports --dry-run and --log

#   Partnership/ssh_setup.sh                — initial setup (idempotent)
#   Partnership/ssh_setup.sh --force        — regenerate + re-copy
#   Partnership/ssh_setup.sh --validate     — health check + strike tracking
#   Partnership/ssh_setup.sh --status       — show key and connectivity state
#   Partnership/ssh_setup.sh --local-only   — generate key locally, skip remote copy
#   Any mode supports --dry-run and --log

+#   Partnership/ssh_setup.sh --local-only   — generate key locally, skip remote copy

#   Any mode supports --dry-run and --log


Now the dead-config fixes — `weekly_health_digest.sh` and `smart_long_test.sh`. These need the dead vars removed from the header and code:


Bash

grep -n "DIGEST_SMART_ON_BANDWIDTH\|SMART_TEMP_WARN\|SMART_TEMP_CRIT" \
    /boot/config/plugins/varaverk/Monitors/weekly_health_digest.sh \
    /boot/config/plugins/varaverk/Tools/smart_long_test.sh

Find dead config var references


/boot/config/plugins/varaverk/Tools/smart_long_test.sh:64:#   SMART_TEMP_WARN / SMART_TEMP_CRIT
/boot/config/plugins/varaverk/Monitors/weekly_health_digest.sh:85:#   DIGEST_SMART_ON_BANDWIDTH
/boot/config/plugins/varaverk/Monitors/weekly_health_digest.sh:141:log "$ICON_GEAR Smart triggers: watchdog=${DIGEST_SMART_ON_WATCHDOG} fallback=${DIGEST_SMART_ON_FALLBACK} cert=${DIGEST_SMART_ON_CERT_WARN} bandwidth=${DIGEST_SMART_ON_BANDWIDTH}"
/boot/config/plugins/varaverk/Monitors/weekly_health_digest.sh:154:    echo "$ICON_DIGEST  Smart triggers: watchdog=$DIGEST_SMART_ON_WATCHDOG fallback=$DIGEST_SMART_ON_FALLBACK cert=$DIGEST_SMART_ON_CERT_WARN bandwidth=$DIGEST_SMART_ON_BANDWIDTH"
/boot/config/plugins/varaverk/Monitors/weekly_health_digest.sh:301:        [[ "$DIGEST_SMART_ON_BANDWIDTH" == true ]] && SHOULD_SEND=true


`DIGEST_SMART_ON_BANDWIDTH` IS used at line 301 — agent missed it. That one's fine. Check `smart_long_test.sh`: