diff --git a/.github/workflows/safety.yml b/.github/workflows/safety.yml
new file mode 100644
index 0000000..f7e3a29
--- /dev/null
+++ b/.github/workflows/safety.yml
@@ -0,0 +1,12 @@
+name: Isolated script safety
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Bash syntax and local fixture regressions
+        run: python3 -m unittest discover -s tests -v
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..41c33c8
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+
+__pycache__/
+*.pyc
diff --git a/README.md b/README.md
index be1981c..344735c 100644
--- a/README.md
+++ b/README.md
@@ -1,187 +1,68 @@
-# 🐧 Linux Admin Scripts
+# Linux Admin Scripts
 
-A production-ready collection of Bash scripts for Linux system administration monitoring, alerting, backup, maintenance, and security auditing.
+11 October reconciliation: the existing safety fixes are reconciled with current main, preserving all four scripts added since September. `backup_verify.sh`, `healthcare_check.sh`, and `log_summary.sh` now distinguish unavailable evidence from successful checks. The suite contains 28 isolated tests. See [REVIEW-2026-10-11.md](REVIEW-2026-10-11.md) for this run's scope and migration notes.
 
-> All scripts include centralized Slack/Teams/Email alerting, lock files, log rotation, and proper error handling.
+9 September continuation: shared backup publication now refuses existing checksum files, symlinks and directories. Both daily and weekly paths publish checksums with no-clobber hard links; a checksum-generation failure cannot report a verified backup. Interrupted publication may still leave an archive without its final checksum, so require a valid checksum pair and investigate retained partial artifacts. This adds two isolated regression tests (12 total); application-consistent restoration remains a lab gate.
 
----
+Bash administration utilities. Validate each script in a disposable lab before production deployment. Syntax checks and fixture tests do not certify an environment or an application backup.
 
-## 📁 Repository Structure
+## Entry points
 
-```
-linux-admin-scripts/
-└── scripts/
-    ├── core/               ← Shared alert engine (load this first)
-    ├── audit/              ← Security & system auditing
-    ├── monitoring/         ← Resource & service monitoring
-    ├── backup/             ← Backup & rotation scripts
-    └── maintenance/        ← Cleanup & housekeeping
-```
+Use `bash <script-path>`; several maintained entry points intentionally have no `.sh` extension.
 
----
+| Path | Behavior and scope |
+| --- | --- |
+| `scripts/monitoring/server-stats.sh` | Local statistics snapshot; unchanged in the September remediation. |
+| `scripts/monitoring/cpu_memory_monitor` | CPU/memory observations; local log and stderr alerts. |
+| `scripts/monitoring/disk_alert` | One GNU df collection; warning/critical or unavailable collection returns nonzero. |
+| `scripts/monitoring/service_uptime <unit> ...` | Explicit service scope, alert-only; never restarts a service. |
+| `scripts/backup/backup_script <source> <existing-destination>` | Verified, versioned file archive; retention inventory only. |
+| `scripts/backup/backup_rotation.sh` | Versioned daily/weekly archives; requires SRC_DIR, BACKUP_DIR and EXPECTED_BACKUP_SOURCE. |
+| `scripts/backup/backup_verify.sh -d <directory>` | Read-only freshness/size check, exact age in seconds; optional `--verify-archive` fails when integrity cannot be verified. |
+| `scripts/monitoring/healthcare_check.sh` | CPU, memory, swap and disk checks; failed, empty or malformed collections return UNKNOWN. |
+| `scripts/monitoring/log_summary.sh -f <log>` | Read-only log summary; numeric rotations optional; failed reads/decompression/timeouts return UNKNOWN. |
+| `scripts/audit/security-audit.sh` | Preserved current-main security audit; not remediated or runtime-validated in this run. |
+| `scripts/Nginx_create.sh <dns-name> <template> <owner>` | Configuration preview. `--apply` installs and validates; `--reload` additionally reloads Nginx. |
+| `scripts/appache2_confg.sh --plan` | Apache installation plan. `--install` is explicit and may start Apache; never changes UFW. |
+| `scripts/audit/LinuxAudit.sh` | Interactive audit. Expensive filesystem scans are opt-in and bounded. |
+| `scripts/audit/FastCheck.sh <host> --scan` | Explicitly authorized TLS/connectivity checks; intrusive NSE/DoS menu removed. |
+| `scripts/audit/ScanPort.sh <IPv4> --scan` | Explicitly authorized checks of the 24 listed TCP ports. |
 
-## 🔔 Core
+The previously documented `system_resource_check` and `maintenance/log_cleanup` scripts are not supplied. Remove references to those nonexistent paths from deployment plans.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/core/alert_engine.sh` | Central alerting module Slack, MS Teams, Email. Sourced by all other scripts. Also provides lock files and log rotation. | Read-only |
+## Alerts, state, and privileges
 
-**Configure this first** before running any other script. Set your Slack webhook, Teams webhook, or email inside this file.
+`scripts/core/alert_engine.sh` supplies locking, log archival, and timestamped **local stderr alerts only**. It does not send Slack, Teams or email. Integrate stdout/stderr and exit status with your approved monitoring system; external delivery is not configured by this repository. The CPU monitor also writes `/var/log/admin-scripts`; provision that protected log directory before deployment. Log archives are retained; configure a separate reviewed retention policy.
 
----
+Locks use `${XDG_STATE_HOME:-$HOME/.local/state}/admin-scripts`, or `ADMIN_SCRIPTS_STATE_DIR`. The state directory must be owned by the executing account, mode 700, with trusted ancestors. Backup directories and configuration parents must be protected against concurrent untrusted writers. Do not run from or deploy into user-writable directories as root.
 
-## 🔍 Audit
+Monitoring needs read access to the selected objects. Backup needs read access to the source and write access to the destination. Nginx `--apply` and Apache `--install` require root and an approved change window. Scan commands contact their target; target-owner approval is required.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/audit/LinuxAudit.sh` | Collects Linux system audit information — users, services, packages, network details, and configuration data. | Read-only / information gathering |
+## Backup configuration and migration
 
----
+1. Provision an existing, protected destination and verify the intended mounted device. Read-only check: `findmnt -n -o SOURCE -T <BackupDirectory>`.
+2. Pin the reviewed value in `EXPECTED_BACKUP_SOURCE`; do not dynamically accept whichever device is mounted at runtime.
+3. Set the source/destination explicitly. Archives include a source-path job identifier and unique timestamp/PID; old daily files are never accepted merely because they exist.
+4. Creation writes to `.partial.*`, checks gzip/tar integrity, then publishes without overwriting an existing archive and writes a SHA256 sidecar. Failures retain clearly marked partial artifacts and return nonzero.
+5. Retention prints job-specific, nonrecursive candidates; it never deletes previous backups. Review retention and capacity separately. Existing legacy archives are retained.
+6. Test restoration into an isolated directory and compare representative files, metadata, ACLs and application consistency. These are file archives, not consistent live-database backups; this implementation does not promise ACL/xattr preservation. Use an application-aware backup when required.
 
-## 📊 Monitoring
+Weekly filenames include the ISO week-year. Publication requires same-filesystem hard-link support. Interrupted runs after publication but before the sidecar completes must be investigated; do not infer completion from filename alone. No automatic cleanup of failed artifacts is performed.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/monitoring/server-stats.sh` | Displays server statistics CPU, memory, disk usage, uptime, and running processes. | Read-only |
-| `scripts/monitoring/cpu_memory_monitor.sh` | Monitors CPU and memory usage. Sends WARNING/CRITICAL alerts when thresholds are exceeded. Uses `vmstat` and `/proc/meminfo` for accuracy. | Read-only |
-| `scripts/monitoring/disk_alert.sh` | Monitors all disk mountpoints. Two alert levels: WARNING at 75%, CRITICAL at 90%. Skips tmpfs/devtmpfs. | Read-only |
-| `scripts/monitoring/service_uptime_checker.sh` | Checks critical services (nginx, docker, mysql). Auto-restarts if down, retries N times, escalates to CRITICAL alert with journal logs if restart fails. | Read/Write (restarts services) |
-| `scripts/monitoring/system_resource_check.sh` | Full hourly system snapshot — CPU, RAM, swap, disk, top processes, network connections, last logins. Saves report to log file. | Read-only |
+## Configuration changes
 
----
+Nginx defaults to stdout preview. Templates are operator-supplied and must be reviewed, including certificate paths and any includes. Existing web roots/sites are refused. Applying checks the baseline first, creates only the new targets, tests the complete configuration, and rolls back only those new targets on failure. Ownership changes are limited to the newly created directory. If `--reload` fails, the previous file configuration is restored and a rollback reload is attempted; a failure is reported for operator intervention. A successful `--apply` without `--reload` stages the site for the next reload.
 
-## 💾 Backup
+Apache installation and firewall activation are separate changes. Before any manual firewall activation, record existing policy, the actual management port/source, console access, rollback commands, and an independent management-session validation. This script does not activate the firewall.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/backup/backup_rotation.sh` | Daily + weekly backup with rotation. Pre-flight checks for source directory and free disk space. Alerts on failure. | Read/Write |
-| `scripts/backup/backup_script.sh` | Compressed backup with archive integrity verification (`tar -tzf`). Cleans backups older than N days. | Read/Write |
+For filesystem audit scans, set `ENABLE_FILESYSTEM_SCAN=1` and an explicit absolute `AUDIT_SCAN_ROOT` only after approving metadata I/O. Results can be incomplete on permission errors or timeout and must be reviewed accordingly.
 
----
+## Validation
 
-## 🧹 Maintenance
+The three October checkers use exit 3 for UNKNOWN/incomplete evidence and exit 2 for invalid usage; `--help` exits 0. Backup and health checkers return 1 for failed checks or exceeded thresholds. Integrations must alert on every nonzero exit, not just 1. Backup age is compared in seconds: a file one second older than the configured threshold fails; a future timestamp is UNKNOWN. Unsupported archive extensions cannot satisfy `--verify-archive`.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/maintenance/log_cleanup.sh` | Deletes log files older than N days. Optional `--archive` flag compresses logs before deletion. Protects `audit.log` and `secure.log`. | Read/Write (deletes files) |
+Log rotation discovery now includes only `.N` and `.N.gz`. Date-named rotations must be supplied explicitly with `-f`. Log scanning has a 60-second timeout per file (plus five seconds to terminate), configurable with `--timeout`; this does not bound total disk space or total runtime across many rotations. Compressed logs are decompressed once with status checked. Health collectors use 30-second timeouts, and memory/swap share one `free` call. These scripts require Bash and GNU/Linux tools (`timeout`, NUL-aware `sort`, GNU `find`/`stat`, plus `gzip`/`tar` or `unzip` for the relevant formats).
 
----
+`python3 -m unittest discover -s tests -v` performs Bash syntax validation, local backup creation/restore fixtures, and mocked systemctl/df/configuration-preview checks. It makes no production calls. GitHub Actions runs the same tests. Nginx reload/rollback, full disks, application restore, production mounts and notification delivery still require environment-specific lab validation.
 
-## ⚙️ Setup
-
-### 1. Clone the repository
-
-```bash
-git clone https://github.com/blow-tech/linux-admin-scripts.git
-cd linux-admin-scripts
-```
-
-### 2. Deploy to server
-
-```bash
-sudo mkdir -p /opt/admin-scripts
-sudo cp -r scripts/* /opt/admin-scripts/
-sudo chmod +x /opt/admin-scripts/**/*.sh
-sudo mkdir -p /var/log/admin-scripts
-```
-
-### 3. Configure alerts
-
-Edit `/opt/admin-scripts/core/alert_engine.sh`:
-
-```bash
-SLACK_ENABLED=true
-SLACK_WEBHOOK_URL="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
-
-TEAMS_ENABLED=true
-TEAMS_WEBHOOK_URL="https://outlook.office.com/webhook/YOUR-WEBHOOK-URL"
-
-SMTP_CONFIGURED=true
-ALERT_EMAIL="admin@yourcompany.com"
-```
-
-### 4. Make scripts executable
-
-```bash
-chmod +x scripts/monitoring/cpu_memory_monitor.sh
-chmod +x scripts/monitoring/disk_alert.sh
-chmod +x scripts/monitoring/service_uptime_checker.sh
-chmod +x scripts/monitoring/system_resource_check.sh
-chmod +x scripts/backup/backup_rotation.sh
-chmod +x scripts/backup/backup_script.sh
-chmod +x scripts/maintenance/log_cleanup.sh
-chmod +x scripts/core/alert_engine.sh
-```
-
-### 5. Run a script
-
-```bash
-./scripts/monitoring/cpu_memory_monitor.sh
-./scripts/monitoring/disk_alert.sh
-./scripts/audit/LinuxAudit.sh
-./scripts/backup/backup_rotation.sh
-./scripts/maintenance/log_cleanup.sh /var/log 14 --archive
-```
-
----
-
-## ⏰ Recommended Crontab
-
-```bash
-sudo crontab -e
-```
-
-```cron
-# CPU & Memory — every 5 minutes
-*/5 * * * * /opt/admin-scripts/monitoring/cpu_memory_monitor.sh
-
-# Disk Alert — every 30 minutes
-*/30 * * * * /opt/admin-scripts/monitoring/disk_alert.sh
-
-# Service Health — every 5 minutes
-*/5 * * * * /opt/admin-scripts/monitoring/service_uptime_checker.sh
-
-# System Resource Snapshot — every hour
-0 * * * * /opt/admin-scripts/monitoring/system_resource_check.sh
-
-# Daily Backup — 2AM every day
-0 2 * * * /opt/admin-scripts/backup/backup_rotation.sh
-
-# Log Cleanup — 3AM every Sunday
-0 3 * * 0 /opt/admin-scripts/maintenance/log_cleanup.sh /var/log 14 --archive
-```
-
----
-
-## 📋 Log Files
-
-All logs are written to `/var/log/admin-scripts/`:
-
-| File | Contents |
-|---|---|
-| `alerts.log` | All alerts from all scripts |
-| `cpu_memory_monitor.log` | CPU/memory check history |
-| `disk_alert.log` | Disk usage check history |
-| `service_uptime_checker.log` | Service status & restart history |
-| `system_resource_check.log` | Hourly resource snapshots |
-| `backup_rotation.log` | Daily/weekly backup history |
-| `backup_script.log` | Backup job history |
-| `log_cleanup.log` | Cleanup activity |
-
----
-
-## 🛡️ Script Safety Features
-
-Every script in this repo includes:
-
-- `set -euo pipefail` — exits immediately on any error
-- Lock files — prevents duplicate cron executions
-- Log rotation — log files are capped automatically
-- Pre-flight validation — checks directories and disk space before acting
-- Alert integration — every failure sends a real-time notification
-
----
-
-## 👤 Author 
-Linux System Administrator  
-GitHub: [@blow-tech](https://github.com/blow-tech)
+The September 2026 remediation corresponds to review findings H2-H5, H9, M1-M2 and the identified Linux performance items. See the pull request for exact validation evidence. Keep existing deployments pinned until their schedule and parameters have been migrated and approved.
diff --git a/REVIEW-2026-10-11.md b/REVIEW-2026-10-11.md
new file mode 100644
index 0000000..6785842
--- /dev/null
+++ b/REVIEW-2026-10-11.md
@@ -0,0 +1,42 @@
+# Linux script remediation — 11 October 2026
+
+This change continues the existing Linux draft PR under the user's renewed approval to fix and improve GitHub scripts. It does not merge, deploy, change schedules, or execute scripts against production.
+
+## Reconciliation
+
+Reviewed main: `81ae9b030416ec45e3cb21605dc1e63a079c0b6a`.
+Previous PR head: `f8ca5736d1ceb6fa75d492df67960b3eb51d5a4d`.
+
+All 17 main files and all files in the previous PR snapshot were checked against GitHub blob hashes before editing. Main's ten shared operational scripts still match the original September base; the prior ten-script safety changes can be retained without discarding later source edits. Main added four scripts, all retained. Three receive the fixes below; `security-audit.sh` remains unchanged. README conflicts are resolved with accurate paths, local-only alert behavior, and current entry points and migration notes.
+
+## New fixes in this run
+
+| Script | Fix and evidence |
+| --- | --- |
+| `scripts/backup/backup_verify.sh` | Compare age in seconds, reject future timestamps and invalid arguments, handle newline filenames with NUL records, retain enumeration failures, and reject unsupported requested integrity checks. Fixtures cover the exact age boundary, stale/future files, denied collection, unusual names, valid/corrupt archives and unsupported formats. |
+| `scripts/monitoring/healthcare_check.sh` | Failed/empty/malformed CPU, memory or disk data becomes UNKNOWN; validate thresholds, collect memory/swap once, preserve mountpoint spaces, use bounded external collectors. Fixtures cover healthy/high-usage paths and failed/malformed collectors. |
+| `scripts/monitoring/log_summary.sh` | Distinguish grep no-match from errors, validate regex/numeric arguments, check decompression and scan exit codes, timeout individual scans, restrict rotations, and avoid head-induced SIGPIPE on large summaries. Fixtures cover corrupt gzip, invalid regex, read errors/timeouts, numeric rotations and large output. |
+
+## Previous fixes retained and reconciled
+
+Ten scripts: `scripts/backup/backup_script`, `scripts/backup/backup_rotation.sh`, `scripts/monitoring/service_uptime`, `scripts/monitoring/disk_alert`, `scripts/monitoring/cpu_memory_monitor`, `scripts/Nginx_create.sh`, `scripts/appache2_confg.sh`, `scripts/audit/FastCheck.sh`, `scripts/audit/ScanPort.sh`, and `scripts/audit/LinuxAudit.sh`.
+
+Two shared modules: `scripts/core/alert_engine.sh` and `scripts/core/backup_engine.sh`.
+
+They retain verified versioned backups and preservation of prior backup/checksum evidence; preview-only retention; explicit service scope without automatic restarts; local alert/locking dependencies; Nginx preview and scoped apply/rollback; separate Apache installation and firewall administration; syntax/input fixes and bounded audit scanning. These are existing PR fixes, not thirteen newly discovered fixes in this run.
+
+## Validation
+
+- 28 isolated Python unittest cases passed locally: 12 retained safety regressions plus 16 collection regressions. The syntax case checks all 17 Bash entry points/modules.
+- Disposable archive round-trip and no-overwrite fixtures passed. No production source, mount, tenant, server, notification destination or network scanning target was used.
+- Failed and malformed command responses are injected with temporary PATH mocks. Timeout handling uses injected timeout exit status; this is not a real hung-process integration test.
+- Existing GitHub Actions workflow runs the same suite. The PR and Actions status are the source of truth for remote validation.
+- No speedup benchmark was performed. Removing the duplicate `free` call is verified by an invocation-count fixture.
+
+## Migration and remaining limits
+
+Checkers now return 3 for UNKNOWN, 2 for usage and 0 for successful help. Alert on every nonzero result. Date-named log rotations require explicit `-f`; automatic inclusion is limited to `.N`/`.N.gz`. Backup `--verify-archive` cannot pass unsupported formats. The README describes changed backup, service, configuration and audit interfaces retained from September.
+
+Application-consistent backup restoration, real Nginx apply/reload/rollback, actual mount/capacity behavior and platform integration still require disposable lab validation before deployment. Backup verification reads metadata and archives in separate operations; run against completed, stable backups. File archive/checksum publication is not a single transaction; incomplete artifacts remain available for investigation. Log scan timeout limits are per input, not a storage or total-job budget.
+
+This run addresses the Linux administration PR only. The separate PowerShell, audit-toolkit and infrastructure findings in the 5 October review remain outside this change; no claim is made that every repository is fixed or production-certified.
diff --git a/scripts/Nginx_create.sh b/scripts/Nginx_create.sh
index 1db5e55..e165a6c 100644
--- a/scripts/Nginx_create.sh
+++ b/scripts/Nginx_create.sh
@@ -1,52 +1,67 @@
-#!/bin/bash
-
-if [[ $EUID -ne 0 ]]; then
-   echo "Only root allowed." 
-   exit 1
+#!/usr/bin/env bash
+# Usage: Nginx_create.sh <dns-name> <reviewed-template> <owner> [--apply] [--reload]
+# Default: print proposed configuration only. --apply installs after baseline validation.
+set -euo pipefail
+[[ $# -ge 3 ]] || { echo 'Supply DNS name, template and existing service owner' >&2; exit 2; }
+vhost=$1 template=$2 owner=$3; shift 3
+apply=false reload=false
+for arg in "$@"; do
+    case $arg in --apply) apply=true ;; --reload) reload=true ;; *) echo "Unknown option: $arg" >&2; exit 2 ;; esac
+done
+[[ ${#vhost} -le 253 && $vhost == *.* && $vhost =~ ^[a-zA-Z0-9.-]+$ ]] || exit 2
+IFS=. read -r -a labels <<< "$vhost"
+[[ $vhost != *. ]] || exit 2
+for label in "${labels[@]}"; do
+    [[ ${#label} -le 63 && $label =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$ ]] || exit 2
+done
+[[ $owner =~ ^[a-zA-Z_][a-zA-Z0-9_-]*$ && -f $template && ! -L $template ]] || exit 2
+id "$owner" >/dev/null
+config=$(sed "s/{{DOMAIN}}/$vhost/g" "$template")
+[[ $config != *'{{'* ]] || { echo 'Unresolved template placeholder' >&2; exit 2; }
+if ! $apply; then
+    printf '%s\n' "$config"
+    echo 'PREVIEW only. Review template, certificate paths and change window before --apply.' >&2
+    exit 0
 fi
-
-TEMPLATE_HTTP="/root/template/nginx-http.conf"
-TEMPLATE_HTTPS="/root/template/nginx-secure-http.conf"
-
-if [ ! -f "$TEMPLATE_HTTP" ] || [ ! -f "$TEMPLATE_HTTPS"]; then
-    echo "Template files not found."
-    exit 1
-fi
-
-read -p "Enter vhost (contoh: example.test): " vhost
-
-# Ask user to choice between HTTP or HTTPS template
-echo "Want to use HTTP or HTTPS?"
-echo "1) HTTP Only"
-echo "2) HTTP + HTTPS"
-read -p "Choice between (1) or (2): " template_choice
-
-if [ "$template_choice" == "1" ]; then
-    TEMPLATE_FILE="$TEMPLATE_HTTP"
-elif [ "$template_choice" == "2" ]; then
-    TEMPLATE_FILE="$TEMPLATE_HTTPS"
-else
-    echo "Wrong choice!"
-    exit 1
-fi
-
-# Create new vhost directory on /var/www/
-mkdir -p /var/www/$vhost
-chown -R baiquni:baiquni /var/www/$vhost
-
-# Create nginx configuration base on template on sites-available
-echo "Membuat file konfigurasi nginx untuk $vhost dari template..."
-sed "s/{{DOMAIN}}/$vhost/g" "$TEMPLATE_FILE" > /etc/nginx/sites-available/$vhost
-
-# Create symlinks into sites-enabled
-ln -s /etc/nginx/sites-available/$vhost /etc/nginx/sites-enabled/
-
-# Check nginx configuration
+(( EUID == 0 )) || { echo '--apply requires root' >&2; exit 1; }
+for parent in /var /var/www /etc /etc/nginx /etc/nginx/sites-available /etc/nginx/sites-enabled; do
+    [[ -d $parent && ! -L $parent ]] || { echo "Missing or symlink parent: $parent" >&2; exit 1; }
+done
+available=/etc/nginx/sites-available/$vhost
+enabled=/etc/nginx/sites-enabled/$vhost
+webroot=/var/www/$vhost
+for path in "$available" "$enabled" "$webroot"; do
+    [[ ! -e $path && ! -L $path ]] || { echo "Refusing existing target: $path" >&2; exit 1; }
+done
+nginx -t
+stage=$(mktemp /etc/nginx/sites-available/.stage.XXXXXX)
+made_available=false made_enabled=false made_root=false committed=false reload_attempted=false
+rollback() {
+    local status=$?
+    if ! $committed; then
+        $made_enabled && rm -- "$enabled"
+        $made_available && rm -- "$available"
+        $made_root && rmdir -- "$webroot"
+        if $reload_attempted; then
+            nginx -t && systemctl reload nginx || echo 'CRITICAL: rollback reload failed; operator action required' >&2
+        fi
+    fi
+    rm -f -- "$stage"
+    return "$status"
+}
+trap rollback EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+printf '%s\n' "$config" > "$stage"
+chmod 644 "$stage"
+mkdir -- "$webroot"; made_root=true
+chown -- "$owner:$(id -gn "$owner")" "$webroot"
+ln -- "$stage" "$available"; made_available=true
+ln -s -- "$available" "$enabled"; made_enabled=true
 nginx -t
-
-if [ $? -eq 0 ]; then
+if $reload; then
+    reload_attempted=true
     systemctl reload nginx
-    echo "Setup vhost $vhost done!"
-else
-    echo "Error found. Only God know where."
 fi
+committed=true
+printf 'Configuration validated and installed: %s; reload requested=%s\n' "$vhost" "$reload"
diff --git a/scripts/appache2_confg.sh b/scripts/appache2_confg.sh
index 68f8000..f624c5d 100644
--- a/scripts/appache2_confg.sh
+++ b/scripts/appache2_confg.sh
@@ -1,11 +1,18 @@
-#!/bin/bash
-
-#Simply Install Apache2 7 configure in firewall
-sudo apt-get install apache2 ufw net-tools -y
-sudo ufw enable
-sudo ufw allow 80
-sudo ufw allow 443
-sudo ufw allow "Apache Full"
-
-echo "Apache 2 Has been Installed & Configured in Firewiall"
-systemctl status apache2 --no-pager
+#!/usr/bin/env bash
+# Default is a plan. Installation can start Apache via package maintainer scripts.
+# Firewall activation is deliberately a separate, reviewed infrastructure change.
+set -euo pipefail
+[[ -r /etc/os-release ]] || exit 1
+source /etc/os-release
+case ${ID:-} in ubuntu|debian) ;; *) echo 'Only Ubuntu/Debian supported' >&2; exit 2 ;; esac
+[[ $# -le 1 && ${1:---plan} =~ ^--(plan|install)$ ]] || exit 2
+printf '%s\n' 'Plan: install apache2. Package installation may start the service.' \
+ 'Firewall prerequisite: review existing UFW policy, actual SSH port/source and out-of-band access.' \
+ 'This script does not install, activate or modify the firewall.'
+if [[ ${1:---plan} == --install ]]; then
+    (( EUID == 0 )) || { echo '--install requires root' >&2; exit 1; }
+    apt-get install --yes apache2
+    apache2ctl configtest
+    systemctl is-active --quiet apache2
+    echo 'Apache installed; configuration valid and service active.'
+fi
diff --git a/scripts/audit/FastCheck.sh b/scripts/audit/FastCheck.sh
index 3885480..4441169 100644
--- a/scripts/audit/FastCheck.sh
+++ b/scripts/audit/FastCheck.sh
@@ -1,151 +1,24 @@
-#!/bin/bash
-tput clear
-trap ctrl_c INT
-
-function ctrl_c() {
-        echo "**You pressed Ctrl+C...Exiting"
-	exit 0;
-}
-#
-echo "#################### ############################## ###############################"
-echo "####################### ############################# ##############################"
-echo "######################## ############################# #############################"
-echo "--------------------------------FastChecker v1.0.1:---------------------------------"
-echo
-echo "Written by sokdr"
-echo
-echo "Nmap [https://nmap.org]  should be isntalled in your linux machine, if not open terminal and type 'sudo apt-get install nmap'"
-echo "waf00f also should be installed on your linux machine, if not then type 'pip install wafw00f' to install it "
-echo "With waf00f pls use FQDN for better resutls:"
-echo "Also the script makes use of hping3 and sslscan tools:"
-echo "####################################################################################"
-echo
-echo "Dear ##$HOSTNAME## Welcome to the Fast VUlnerability Checker v1.0.1:"
-echo "======================================================="
-echo "I provide you with your public IP address:"
-curl -s http://checkip.dyndns.org/ | grep -o "[[:digit:].]\+"
-echo "======================================================="
-echo
-echo -n " Please enter the IP/FQDN you want to check: "
-read hostname
-echo "OK...now checking the availability of $hostname:"
-fping -c1 -t300 $hostname 2>/dev/null 1>/dev/null  #fping to define the timeout in milliseconds
-if [ "$?" = 1 ]   								   #1 unreachable 0 reachable
-then
-	echo "$hostname does not exist run the script again pls:"
-	exit 0;
-else
-	echo "OK moving on to the check-list:"
+#!/usr/bin/env bash
+# Scoped connectivity/TLS inspection. No DoS, exploit or vulnerability NSE categories.
+set -euo pipefail
+[[ $# == 2 && $2 == --scan ]] || { echo 'Usage: FastCheck.sh <DNS-name-or-IPv4> --scan (requires target-owner approval)' >&2; exit 2; }
+host=$1
+[[ ${#host} -le 253 && $host =~ ^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$ && $host != *..* ]] || exit 2
+if [[ $host =~ ^[0-9.]+$ ]]; then
+    [[ $host =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || exit 2
+    IFS=. read -r -a octets <<< "$host"
+    for octet in "${octets[@]}"; do (( 10#$octet <= 255 )) || exit 2; done
 fi
-echo
-echo "Here is the list of vulnerabilities and checks you want to search:"
-echo
-PS3='Please enter your choice: '
-options=("Poodle check" "Heartbleed check" "SSL/TLS check" "ftp-anon" "Shellshock check" "Slowloris check" "HTTP-Methods" "TCP timestamp" "WebServer Information" "Strict-Transport-Security" "Banner grabbing" "WAF detection" "Check DoS attack" "Quit")
-select opt in "${options[@]}"
-do
-    case $opt in
-        "Poodle check")
-		echo "Searching for Poodle vulnerability:"
-		echo
-		echo "Poodle scanner start to check hosts:"
-		nmap -sS -sV --version-light --script ssl-poodle -p 443 $hostname
-		echo
-            ;;
-        "Heartbleed check")
-		echo "Searching for Heartbleed vulnerability:"
-		echo
-		echo "Now starting Heartbleed check:"
-		nmap -p 443 --script ssl-heartbleed $hostname
-		echo
-            ;;
-        "SSL/TLS check")
-        read -p "Please choose between Nmap or SSLscan $program [nmap sslscan]:" answer #choose nmap or sslscan
-		if [[ $answer = nmap ]]; then
-				nmap -sS --script ssl-enum-ciphers -p 443 $hostname
-				echo
-       elif [[ $answer = sslscan ]]; then
-				sslscan --no-failed $hostname
-				echo
-		else echo "wrong try again-:-"
-		fi
-		echo
-            ;;
-	"ftp-anon")
-		echo "check for anonymous FTP connections:"
-		echo
-		nmap -sV -sC -p21 $hostname
-		echo
-	    ;;
-	"Shellshock check")
-		echo "check for Shellshock Vulnerability:"
-		echo
-		nmap -sV -p- --script http-shellshock $hostname
-		echo
-	    ;;
-	"Slowloris check")
-		echo "check for Slowloris Vulnerability:"
-		echo
-		nmap --script http-slowloris-check $hostname
-		echo
-	    ;;
-	"HTTP-Methods")
-		echo "Check HTTP methods:"
-		echo
-		nmap -sS -Pn -p 80,443 -script http-methods $hostname
-		echo
-		;;
-    "TCP timestamp")
-		echo "Checking timestamps:"
-		echo
-		hping3 -S -c 1 -p 443 $hostname --tcp-timestamp
-		echo
-		;;
-	"WebServer Information")
-		echo "Checking webserver information:"
-		echo
-		curl -I -L $hostname
-		echo
-		;;
-	"Strict-Transport-Security")
-		echo "Checking Strict-Transport-Security:"
-		echo
-		curl -si $hostname | grep "Strict"
-		echo
-		;;
-	"Banner grabbing")
-		echo "Checking banners"
-		echo -n "Enter the port you want to check:"
-		read port
-		echo
-		nc $hostname $port
-		echo
-		;;
-	"WAF detection")
-		echo "Check if the targeted hosts are protected by a WAF:"
-		echo
-		echo "Please note that wafw00f script is used to identify the following WAFs: also pls provide FQDN to test"
-		wafw00f -l
-		read -p "Do you want to continue $foo? [yn]" answer
-		if [[ $answer = y ]];
-		then
-			wafw00f $hostname -v
-		fi
-		echo
-	    ;;
-	"Check DoS attack")
-		echo "Check the $hostname if it is vulnerable to DoS attacks:" 	
-		echo
-		echo -n "Enter the port you want to check:"
-		read port
-		#nmap -v --script dos
-		echo
-		nmap --script dos -Pn $hostname $port 
-     "Quit")
-            break
-            ;;
-        *) echo invalid option;;
+PS3='Select check: '
+select choice in 'HTTPS headers' 'TLS certificate' 'TCP port' 'Quit'; do
+    case $choice in
+        'HTTPS headers') curl --connect-timeout 5 --max-time 20 --head -- "https://$host" || exit $? ;;
+        'TLS certificate') timeout 20 openssl s_client -connect "$host:443" -servername "$host" -verify_return_error -verify_hostname "$host" </dev/null || exit $? ;;
+        'TCP port')
+            read -r -p 'Port (1-65535): ' port
+            [[ $port =~ ^[0-9]{1,5}$ ]] && (( 10#$port >= 1 && 10#$port <= 65535 )) || { echo 'Invalid port' >&2; continue; }
+            timeout 5 nc -vz -w 3 "$host" "$((10#$port))" || echo 'Connection failed; host availability unknown' >&2 ;;
+        Quit) break ;;
+        *) echo 'Invalid option' >&2 ;;
     esac
 done
-
-
diff --git a/scripts/audit/LinuxAudit.sh b/scripts/audit/LinuxAudit.sh
index 3d0f614..bd35567 100644
--- a/scripts/audit/LinuxAudit.sh
+++ b/scripts/audit/LinuxAudit.sh
@@ -2,7 +2,7 @@
 # LinuxAudit - Targeted Security Audit Tool
 # Interactive menu: run only what you need
 
-tput clear
+tput clear 2>/dev/null || true
 
 ctrl_c() {
   echo ""
@@ -11,6 +11,10 @@ ctrl_c() {
 }
 trap ctrl_c INT
 
+umask 077
+if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+  [[ ${AUDIT_SCAN_ROOT:-} == /* && -d ${AUDIT_SCAN_ROOT:-} ]] || { echo "Invalid AUDIT_SCAN_ROOT" >&2; exit 2; }
+fi
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 OUTPUT_FILE="$SCRIPT_DIR/LinuxAudit_$(hostname)_$(date +%Y%m%d_%H%M%S).txt"
 
@@ -186,7 +190,11 @@ audit_disk_memory() {
   sep
 
   hdr "Largest Directories Under / (top 20, skipping pseudo-fs)"
-  du -x --max-depth=3 / 2>/dev/null | sort -rh | head -20; echo
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 du -x --max-depth=3 "${AUDIT_SCAN_ROOT:?Set an approved absolute scan directory}" | sort -rn | head -20
+  else
+    echo "Skipped: set ENABLE_FILESYSTEM_SCAN=1 and AUDIT_SCAN_ROOT after approving metadata I/O."
+  fi
   sep
 }
 
@@ -303,12 +311,16 @@ audit_security() {
   sep
 
   hdr "World-Writable Files"
-  find / -xdev -type f -perm -0002 2>/dev/null | head -50
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 find "${AUDIT_SCAN_ROOT:?Set approved scan root}" -xdev -type f -perm -0002 | head -50
+  else echo "Filesystem scan skipped."; fi
   echo
   sep
 
   hdr "SUID / SGID Binaries"
-  find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 find "${AUDIT_SCAN_ROOT:?Set approved scan root}" -xdev \( -perm -4000 -o -perm -2000 \) -type f
+  else echo "Filesystem scan skipped."; fi
   echo
   sep
 
diff --git a/scripts/audit/ScanPort.sh b/scripts/audit/ScanPort.sh
index 9cef4b3..11ee95c 100644
--- a/scripts/audit/ScanPort.sh
+++ b/scripts/audit/ScanPort.sh
@@ -1,49 +1,23 @@
-!/usr/bin/env bash
-#sokdr
-
-tput clear
-trap ctrl_c INT
-
-function ctrl_c() {
-    echo "** You pressed Ctrl+C... Exiting Script;"
-    exit 0
-}
-
-ip="$1"
-
-# List of top 200 common TCP ports
-top_ports=("20" "21" "22" "23" "25" "53" "80" "110" "123" "135" "139" "143" "443" "445" "993" "995" "1433" "1521" "3306" "3389" "5432" "5900" "8080" "8443")
-
-# Check if a valid IPv4 address is provided
-if [[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ; then
-    echo "#######################################"
-    echo "######## Welcome to ScanPort Script ########"
-    echo "Now checking availability of $ip"
-    
-    START=$(date +%s)
-
-    # Ping the IP address to check if the host is up
-    if ping -c1 $ip >/dev/null 2>&1; then
-        echo "Host is up.... OK ;)"
-
-        
-        echo "Scanning top 200 TCP ports on $ip "
-        echo "========================================================"
-        
-        
-        for port in "${top_ports[@]}"; do
-            nc -vz -w 2 -n $ip $port
-        done
-
-        END=$(date +%s)
-        DIFF=$(( END - START ))
-        echo
-        echo "Script completed in $DIFF seconds."
+#!/usr/bin/env bash
+# Authorized, single-host TCP connectivity checks only; never infer host-down from ICMP.
+set -euo pipefail
+[[ $# == 2 && $2 == --scan ]] || { echo 'Usage: ScanPort.sh <IPv4> --scan (requires target-owner approval)' >&2; exit 2; }
+ip=$1
+[[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || exit 2
+IFS=. read -r -a octets <<< "$ip"
+for octet in "${octets[@]}"; do (( 10#$octet <= 255 )) || exit 2; done
+command -v nc >/dev/null
+command -v timeout >/dev/null
+ports=(20 21 22 23 25 53 80 110 123 135 139 143 443 445 993 995 1433 1521 3306 3389 5432 5900 8080 8443)
+printf 'Checking %s TCP ports on %s\n' "${#ports[@]}" "$ip"
+for port in "${ports[@]}"; do
+    if timeout 4 nc -z -w 2 -n "$ip" "$port"; then
+        printf '%s OPEN\n' "$port"
     else
-        echo "Host seems to be down.... exiting"
-        exit 1
+        status=$?
+        case $status in
+            1|124) printf '%s CLOSED/FILTERED/TIMED OUT\n' "$port" ;;
+            *) echo "Probe tool failed (exit $status)" >&2; exit "$status" ;;
+        esac
     fi
-else
-    echo "Invalid IPv4 address. Please enter a valid address."
-    exit 1
-fi
+done
diff --git a/scripts/backup/backup_rotation.sh b/scripts/backup/backup_rotation.sh
index d6f4b3e..3079055 100644
--- a/scripts/backup/backup_rotation.sh
+++ b/scripts/backup/backup_rotation.sh
@@ -1,117 +1,30 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : backup_rotation.sh
-# Purpose     : Daily + weekly backup with rotation and alerts
-# Usage       : ./backup_rotation.sh
-#               Recommended cron: 0 2 * * *  (2AM daily)
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# Required: SRC_DIR, BACKUP_DIR (existing), EXPECTED_BACKUP_SOURCE.
+# Versioned daily/weekly archives; retention is inventory-only.
 set -euo pipefail
-
-SCRIPT_NAME="backup_rotation"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-SRC_DIR="/var/www/html"     # Directory to back up
-BACKUP_DIR="/backups"        # Backup destination root
-DAILY_KEEP=7                 # Keep last N daily backups
-WEEKLY_KEEP=4                # Keep last N weekly backups
-MIN_FREE_MB=500              # Abort if less than this MB free on backup disk
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+umask 077
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-mkdir -p "$BACKUP_DIR/daily"
-mkdir -p "$BACKUP_DIR/weekly"
-
-rotate_log "$LOG_FILE" 10240
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d")
-WEEK_NUM=$(date +%V)
-DAY_OF_WEEK=$(date +%u)   # 1=Monday … 7=Sunday
-TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")
-
-log() { echo "[$TIMESTAMP] $*" | tee -a "$LOG_FILE"; }
-
-log "=== Backup rotation started on $HOST ==="
-
-# ----------------------------------------------------------
-# Pre-flight: check source exists
-# ----------------------------------------------------------
-if [ ! -d "$SRC_DIR" ]; then
-    MSG="Source directory $SRC_DIR does not exist on $HOST!"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Missing Source" "$MSG"
-    exit 1
+source "$SCRIPT_DIR/../core/backup_engine.sh"
+lock_script backup_rotation
+backup_preflight "${SRC_DIR:?Set SRC_DIR}" "${BACKUP_DIR:?Set BACKUP_DIR}"
+for dir in "$BACKUP_DIR/daily" "$BACKUP_DIR/weekly"; do
+    [[ ! -L $dir ]] || { echo 'Refusing symlink backup subdirectory' >&2; exit 1; }
+    mkdir -p -- "$dir"
+done
+JOB_ID=$(printf %s "$SOURCE_DIR" | sha256sum | cut -c1-16)
+STAMP=$(date -u +%Y%m%dT%H%M%S)-$$
+BACKUP_FILE="$BACKUP_DIR/daily/admin-daily-${JOB_ID}-${STAMP}.tar.gz"
+create_verified_archive "$BACKUP_FILE"
+if [[ $(date -u +%u) == 7 ]]; then
+    WEEKLY_FILE="$BACKUP_DIR/weekly/admin-weekly-${JOB_ID}-$(date -u +%G-W%V)-${STAMP}.tar.gz"
+    PARTIAL=$(mktemp "${WEEKLY_FILE}.partial.XXXXXX")
+    cp -- "$BACKUP_FILE" "$PARTIAL"
+    cmp -- "$BACKUP_FILE" "$PARTIAL"
+    publish_verified_archive "$PARTIAL" "$WEEKLY_FILE"
 fi
-
-# ----------------------------------------------------------
-# Pre-flight: check free disk space on backup destination
-# ----------------------------------------------------------
-FREE_MB=$(df -BM "$BACKUP_DIR" | awk 'NR==2 {gsub(/M/,"",$4); print $4}')
-if [ "$FREE_MB" -lt "$MIN_FREE_MB" ]; then
-    MSG="Only ${FREE_MB}MB free on $BACKUP_DIR (minimum: ${MIN_FREE_MB}MB). Backup aborted on $HOST."
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Disk Space Low" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Daily backup
-# ----------------------------------------------------------
-BACKUP_FILE="$BACKUP_DIR/daily/backup-$DATE.tar.gz"
-
-if [ -f "$BACKUP_FILE" ]; then
-    log "⏭️  Daily backup for $DATE already exists — skipping creation."
-else
-    log "📦 Creating daily backup: $BACKUP_FILE ..."
-    if tar -czf "$BACKUP_FILE" "$SRC_DIR" 2>>"$LOG_FILE"; then
-        SIZE=$(du -sh "$BACKUP_FILE" | cut -f1)
-        log "✅ Daily backup created: $BACKUP_FILE ($SIZE)"
-        alert_info "$SCRIPT_NAME" "Backup Success — $HOST" \
-            "Daily backup created: $BACKUP_FILE ($SIZE)"
-    else
-        MSG="tar failed for $SRC_DIR → $BACKUP_FILE on $HOST"
-        log "❌ FAILED: $MSG"
-        alert_critical "$SCRIPT_NAME" "Backup FAILED — $HOST" "$MSG"
-        exit 1
-    fi
-fi
-
-# ----------------------------------------------------------
-# Rotate old daily backups
-# ----------------------------------------------------------
-DELETED=$(find "$BACKUP_DIR/daily" -type f -mtime +"$DAILY_KEEP" -name "*.tar.gz" \
-          -print -delete 2>>"$LOG_FILE" | wc -l)
-log "🧹 Daily rotation: removed $DELETED old backup(s) older than $DAILY_KEEP days."
-
-# ----------------------------------------------------------
-# Weekly backup (every Sunday)
-# ----------------------------------------------------------
-if [ "$DAY_OF_WEEK" -eq 7 ]; then
-    WEEKLY_FILE="$BACKUP_DIR/weekly/backup-week-$WEEK_NUM.tar.gz"
-
-    if [ -f "$WEEKLY_FILE" ]; then
-        log "⏭️  Weekly backup for week $WEEK_NUM already exists — skipping."
-    else
-        log "📦 Creating weekly backup: $WEEKLY_FILE ..."
-        cp "$BACKUP_FILE" "$WEEKLY_FILE"
-        SIZE=$(du -sh "$WEEKLY_FILE" | cut -f1)
-        log "✅ Weekly backup created: $WEEKLY_FILE ($SIZE)"
-        alert_info "$SCRIPT_NAME" "Weekly Backup Success — $HOST" \
-            "Weekly backup (week $WEEK_NUM) created: $WEEKLY_FILE ($SIZE)"
-    fi
-
-    # Rotate old weekly backups (older than WEEKLY_KEEP * 7 days)
-    WDELETED=$(find "$BACKUP_DIR/weekly" -type f -mtime +"$((7 * WEEKLY_KEEP))" -name "*.tar.gz" \
-               -print -delete 2>>"$LOG_FILE" | wc -l)
-    log "🧹 Weekly rotation: removed $WDELETED old weekly backup(s)."
-fi
-
-log "=== Backup rotation completed successfully ==="
+alert_info backup_rotation 'Backup verified' "$BACKUP_FILE"
+preview_retention "$BACKUP_DIR/daily" "admin-daily-${JOB_ID}-*.tar.gz" "${DAILY_KEEP:-7}"
+WEEKLY_KEEP=${WEEKLY_KEEP:-4}
+[[ $WEEKLY_KEEP =~ ^[1-9][0-9]*$ ]] || exit 2
+preview_retention "$BACKUP_DIR/weekly" "admin-weekly-${JOB_ID}-*.tar.gz" "$((7 * WEEKLY_KEEP))"
diff --git a/scripts/backup/backup_script b/scripts/backup/backup_script
index a204118..57861be 100644
--- a/scripts/backup/backup_script
+++ b/scripts/backup/backup_script
@@ -1,99 +1,15 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : backup_script.sh
-# Purpose     : Compressed backup with verification + alerts
-# Usage       : ./backup_script.sh [source_dir] [backup_dir]
-#               Defaults to Documents → Backups if no args given
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# EXPECTED_BACKUP_SOURCE='<findmnt SOURCE>' bash backup_script <source> <existing-backup-directory>
 set -euo pipefail
-
-SCRIPT_NAME="backup_script"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+umask 077
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-# =================== CONFIGURATION =========================
-SOURCE_DIR="${1:-/home/$USER/Documents}"
-BACKUP_DIR="${2:-/home/$USER/Backups}"
-KEEP_DAYS=7           # Auto-delete backups older than N days
-MIN_FREE_MB=200        # Abort if disk has less than this free
-# ===========================================================
-
-TIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")
-BACKUP_FILE="$BACKUP_DIR/backup_${TIMESTAMP}.tar.gz"
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-HOST=$(hostname)
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "=== Backup started: $SOURCE_DIR → $BACKUP_DIR ==="
-
-# ----------------------------------------------------------
-# Validate source
-# ----------------------------------------------------------
-if [ ! -e "$SOURCE_DIR" ]; then
-    MSG="Source path does not exist: $SOURCE_DIR on $HOST"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Ensure backup directory exists and has space
-# ----------------------------------------------------------
-mkdir -p "$BACKUP_DIR"
-
-FREE_MB=$(df -BM "$BACKUP_DIR" | awk 'NR==2 {gsub(/M/,"",$4); print $4}')
-if [ "$FREE_MB" -lt "$MIN_FREE_MB" ]; then
-    MSG="Insufficient disk space: only ${FREE_MB}MB free in $BACKUP_DIR (need ${MIN_FREE_MB}MB) on $HOST"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Low Disk Space" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Create the backup
-# ----------------------------------------------------------
-log "📦 Creating backup: $BACKUP_FILE ..."
-if tar -czf "$BACKUP_FILE" "$SOURCE_DIR" 2>>"$LOG_FILE"; then
-    SIZE=$(du -sh "$BACKUP_FILE" | cut -f1)
-    log "✅ Backup successful — $BACKUP_FILE ($SIZE)"
-    alert_info "$SCRIPT_NAME" "Backup Success — $HOST" \
-        "Backup of $SOURCE_DIR completed.\nFile: $BACKUP_FILE\nSize: $SIZE"
-else
-    MSG="tar failed: $SOURCE_DIR → $BACKUP_FILE on $HOST"
-    log "❌ FAILED: $MSG"
-    # Clean up partial file
-    rm -f "$BACKUP_FILE"
-    alert_critical "$SCRIPT_NAME" "Backup FAILED — $HOST" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Verify the archive is not corrupt
-# ----------------------------------------------------------
-log "🔍 Verifying archive integrity ..."
-if tar -tzf "$BACKUP_FILE" > /dev/null 2>&1; then
-    log "✅ Archive integrity OK."
-else
-    MSG="Archive verification FAILED for $BACKUP_FILE on $HOST — file may be corrupt!"
-    log "❌ $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Corrupt — $HOST" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Rotate old backups
-# ----------------------------------------------------------
-DELETED=$(find "$BACKUP_DIR" -type f -mtime +"$KEEP_DAYS" -name "*.tar.gz" \
-          -print -delete 2>>"$LOG_FILE" | wc -l)
-log "🧹 Cleaned $DELETED backup(s) older than $KEEP_DAYS days."
-log "=== Backup process completed ==="
+source "$SCRIPT_DIR/../core/backup_engine.sh"
+[[ $# == 2 ]] || { echo 'Supply source and existing backup directory' >&2; exit 2; }
+lock_script backup_script
+backup_preflight "$1" "$2"
+JOB_ID=$(printf %s "$SOURCE_DIR" | sha256sum | cut -c1-16)
+BACKUP_FILE="$BACKUP_DIR/admin-backup-${JOB_ID}-$(date -u +%Y%m%dT%H%M%S)-$$.tar.gz"
+create_verified_archive "$BACKUP_FILE"
+alert_info backup_script 'Backup verified' "$BACKUP_FILE"
+preview_retention "$BACKUP_DIR" "admin-backup-${JOB_ID}-*.tar.gz" "${KEEP_DAYS:-7}"
diff --git a/scripts/backup/backup_verify.sh b/scripts/backup/backup_verify.sh
index af60aeb..11cea68 100644
--- a/scripts/backup/backup_verify.sh
+++ b/scripts/backup/backup_verify.sh
@@ -1,135 +1,69 @@
 #!/usr/bin/env bash
-#
-# backup-verify.sh
-#
-# Read-only backup validation. Checks a backup directory for the presence
-# of a recent file, verifies it's non-empty, and (optionally) validates
-# archive integrity for common formats (tar, tar.gz, zip) without
-# extracting or modifying anything.
-# author blow_tech
-# Usage:
-#   ./backup-verify.sh -d /backups/sql -m 24
-#   ./backup-verify.sh -d /backups/sql --pattern "*.tar.gz" -m 24 --verify-archive
-#
-# Options:
-#   -d, --dir PATH            Backup directory to check (required)
-#   -m, --max-age-hours N     Alert if newest matching file is older than N hours (default: 24)
-#   --pattern GLOB            Filename glob to match (default: *)
-#   --verify-archive          Test archive integrity (tar/tar.gz/zip) without extracting
-#   -h, --help                 Show this help message
-#
-# Exit codes:
-#   0  Backup found, within age threshold, and (if requested) integrity check passed
-#   1  Backup missing, stale, empty, or failed integrity check
-#   2  Invalid usage
-#
-# Requires: find, stat, tar (--list / -t for integrity), unzip (-t for integrity, optional).
-# Read-only: uses tar -t / unzip -t which list/test contents without writing to disk.
-
+# Read-only backup validation; integrity checks do not prove restorability.
+# Exit: 0 verified requested checks, 1 failed checks, 2 usage, 3 unavailable evidence.
 set -euo pipefail
-
-BACKUP_DIR=""
-MAX_AGE_HOURS=24
-PATTERN="*"
-VERIFY_ARCHIVE=0
-
-usage() {
-    grep '^#' "$0" | sed -e 's/^#//' -e '1d'
-    exit 2
-}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        -d|--dir) BACKUP_DIR="$2"; shift 2 ;;
-        -m|--max-age-hours) MAX_AGE_HOURS="$2"; shift 2 ;;
-        --pattern) PATTERN="$2"; shift 2 ;;
+export LC_ALL=C
+BACKUP_DIR='' MAX_AGE_HOURS=24 PATTERN='*' VERIFY_ARCHIVE=0
+usage() { echo 'Usage: backup_verify.sh -d DIR [-m HOURS] [--pattern GLOB] [--verify-archive]'; }
+unknown() { echo "STATUS: UNKNOWN — $*" >&2; exit 3; }
+bad_usage() { echo "Error: $*" >&2; usage >&2; exit 2; }
+while (( $# )); do
+    case $1 in
+        -d|--dir|-m|--max-age-hours|--pattern)
+            (( $# >= 2 )) || bad_usage "Missing value for $1"
+            case $1 in
+                -d|--dir) BACKUP_DIR=$2 ;;
+                -m|--max-age-hours) MAX_AGE_HOURS=$2 ;;
+                --pattern) PATTERN=$2 ;;
+            esac
+            shift 2 ;;
         --verify-archive) VERIFY_ARCHIVE=1; shift ;;
-        -h|--help) usage ;;
-        *) echo "Unknown option: $1" >&2; usage ;;
+        -h|--help) usage; exit 0 ;;
+        *) bad_usage "Unknown option: $1" ;;
     esac
 done
-
-if [[ -z "$BACKUP_DIR" ]]; then
-    echo "Error: -d/--dir is required" >&2
-    usage
+[[ -n $BACKUP_DIR && -d $BACKUP_DIR ]] || bad_usage 'An existing backup directory is required'
+[[ $MAX_AGE_HOURS =~ ^[0-9]{1,6}$ ]] || bad_usage 'Hours must be a nonnegative integer of at most six digits'
+MAX_AGE_HOURS=$((10#$MAX_AGE_HOURS))
+BACKUP_DIR=$(realpath -e -- "$BACKUP_DIR") || unknown 'Cannot resolve backup directory'
+umask 077
+WORK=$(mktemp -d) || unknown 'Cannot allocate private temporary directory'
+trap 'rm -rf -- "$WORK"' EXIT
+# NUL records preserve spaces/newlines. Check find AND sort status without head/SIGPIPE.
+if ! find "$BACKUP_DIR" -maxdepth 1 -type f -name "$PATTERN" -printf '%T@ %p\0' | sort -z -nr > "$WORK/files"; then
+    unknown 'Backup enumeration failed'
 fi
-
-if [[ ! -d "$BACKUP_DIR" ]]; then
-    echo "Error: directory not found: $BACKUP_DIR" >&2
-    exit 2
+RECORD=''
+if ! IFS= read -r -d '' RECORD < "$WORK/files"; then
+    echo 'STATUS: FAIL — no matching backup files'; exit 1
 fi
-
-echo "=== Backup Verification: ${BACKUP_DIR} — $(date '+%Y-%m-%d %H:%M:%S') ==="
-echo "Pattern: ${PATTERN}  |  Max age: ${MAX_AGE_HOURS}h"
-
-# Find the newest matching file (read-only)
-NEWEST=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "$PATTERN" -printf '%T@ %p\n' 2>/dev/null \
-    | sort -rn | head -n1 | cut -d' ' -f2- || true)
-
-if [[ -z "$NEWEST" ]]; then
-    echo "STATUS: FAIL — no files matching '${PATTERN}' found in ${BACKUP_DIR}"
-    exit 1
-fi
-
-echo "Newest backup: ${NEWEST}"
-
-FILE_SIZE=$(stat -c%s "$NEWEST")
-FILE_AGE_SEC=$(( $(date +%s) - $(stat -c%Y "$NEWEST") ))
-FILE_AGE_HOURS=$(( FILE_AGE_SEC / 3600 ))
-
-echo "Size: ${FILE_SIZE} bytes"
-echo "Age: ${FILE_AGE_HOURS} hour(s)"
-
+NEWEST=${RECORD#* }
+META=$(stat -c '%s %Y' -- "$NEWEST") || unknown 'Cannot stat newest backup'
+read -r FILE_SIZE MTIME <<< "$META"
+NOW=$(date +%s) || unknown 'Cannot read current time'
+[[ $FILE_SIZE =~ ^[0-9]+$ && $MTIME =~ ^-?[0-9]+$ && $NOW =~ ^[0-9]+$ ]] || unknown 'Malformed file metadata'
+FILE_AGE_SEC=$((NOW-MTIME))
+printf 'Newest backup: %q\nSize: %s bytes\nAge: %s seconds\n' "$NEWEST" "$FILE_SIZE" "$FILE_AGE_SEC"
+(( FILE_AGE_SEC >= 0 )) || unknown 'Backup timestamp is in the future; check clock consistency'
 EXIT_CODE=0
-
-if [[ "$FILE_SIZE" -eq 0 ]]; then
-    echo "STATUS: FAIL — backup file is empty"
-    EXIT_CODE=1
-fi
-
-if [[ "$FILE_AGE_HOURS" -gt "$MAX_AGE_HOURS" ]]; then
-    echo "STATUS: FAIL — backup is older than ${MAX_AGE_HOURS}h threshold"
-    EXIT_CODE=1
+if (( FILE_SIZE == 0 )); then echo 'STATUS: FAIL — backup is empty'; EXIT_CODE=1; fi
+if (( FILE_AGE_SEC > MAX_AGE_HOURS * 3600 )); then
+    echo "STATUS: FAIL — backup is older than ${MAX_AGE_HOURS}h"; EXIT_CODE=1
 fi
-
-if [[ "$VERIFY_ARCHIVE" -eq 1 ]]; then
-    echo "--- Archive integrity check (read-only) ---"
-    case "$NEWEST" in
+if (( VERIFY_ARCHIVE )); then
+    case $NEWEST in
         *.tar.gz|*.tgz)
-            if tar -tzf "$NEWEST" &>/dev/null; then
-                echo "Archive integrity: OK (tar.gz)"
-            else
-                echo "Archive integrity: FAIL — corrupt or unreadable tar.gz"
-                EXIT_CODE=1
-            fi
-            ;;
-        *.tar)
-            if tar -tf "$NEWEST" &>/dev/null; then
-                echo "Archive integrity: OK (tar)"
-            else
-                echo "Archive integrity: FAIL — corrupt or unreadable tar"
-                EXIT_CODE=1
-            fi
-            ;;
+            if ! gzip -t -- "$NEWEST" || ! tar -tzf "$NEWEST" >/dev/null; then EXIT_CODE=1; fi ;;
+        *.tar) if ! tar -tf "$NEWEST" >/dev/null; then EXIT_CODE=1; fi ;;
         *.zip)
-            if command -v unzip &>/dev/null && unzip -t "$NEWEST" &>/dev/null; then
-                echo "Archive integrity: OK (zip)"
-            else
-                echo "Archive integrity: FAIL — corrupt, unreadable zip, or unzip not installed"
-                EXIT_CODE=1
-            fi
-            ;;
-        *)
-            echo "Archive integrity: SKIPPED — unrecognized extension for '${NEWEST}'"
-            ;;
+            command -v unzip >/dev/null || unknown 'unzip is required for ZIP integrity verification'
+            if ! unzip -t "$NEWEST" >/dev/null; then EXIT_CODE=1; fi ;;
+        *) unknown 'Requested integrity check is unsupported for this file extension' ;;
     esac
 fi
-
-echo
-if [[ "$EXIT_CODE" -eq 0 ]]; then
-    echo "Backup verification passed."
+if (( EXIT_CODE == 0 )); then
+    echo 'Backup verification passed (requested checks only; restore test still required).'
 else
-    echo "Backup verification FAILED. Review output above."
+    echo 'Backup verification FAILED.'
 fi
-
 exit "$EXIT_CODE"
diff --git a/scripts/core/alert_engine.sh b/scripts/core/alert_engine.sh
new file mode 100644
index 0000000..9d38659
--- /dev/null
+++ b/scripts/core/alert_engine.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Local alerts only: no mail/webhook destination is assumed or contacted.
+# Sourcing this file performs no work.
+alert_emit() { printf '%s [%s] %s: %s -- %s\n' "$(date -Is)" "$1" "$2" "$3" "$4" >&2; }
+alert_info() { alert_emit INFO "$@"; }
+alert_warning() { alert_emit WARNING "$@"; }
+alert_critical() { alert_emit CRITICAL "$@"; }
+lock_script() {
+    local name=$1 dir=${ADMIN_SCRIPTS_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/admin-scripts}
+    [[ $name =~ ^[a-zA-Z0-9_-]+$ ]] || return 1
+    command -v flock >/dev/null || { echo 'flock is required' >&2; return 1; }
+    (umask 077; mkdir -p -- "$dir") || return 1
+    [[ ! -L $dir && -O $dir && $(stat -c %a -- "$dir") == 700 ]] || {
+        echo 'State directory must be owned by this user, mode 700, and not a symlink' >&2; return 1;
+    }
+    [[ ! -L $dir/$name.lock ]] || return 1
+    exec {ADMIN_SCRIPTS_LOCK_FD}>"$dir/$name.lock" || return 1
+    flock -n "$ADMIN_SCRIPTS_LOCK_FD" || { echo "Another $name run holds the lock" >&2; return 1; }
+}
+rotate_log() {
+    local path=$1 limit_kib=$2 archive
+    [[ ! -L $path && $limit_kib =~ ^[0-9]+$ ]] || return 1
+    if [[ -f $path ]] && (( $(stat -c %s -- "$path") > limit_kib * 1024 )); then
+        archive=$(mktemp "${path}.$(date +%Y%m%dT%H%M%S).XXXXXX") || return 1
+        mv -- "$path" "$archive" || return 1
+        # Retain evidence for a separately configured retention policy.
+    fi
+}
diff --git a/scripts/core/backup_engine.sh b/scripts/core/backup_engine.sh
new file mode 100644
index 0000000..ebb404e
--- /dev/null
+++ b/scripts/core/backup_engine.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Fail-closed file backups. Live databases require application-specific backups.
+backup_preflight() {
+    local source=$1 destination=$2 actual needed available tool
+    for tool in realpath findmnt tar gzip df du sha256sum mktemp flock; do
+        command -v "$tool" >/dev/null || { echo "Missing dependency: $tool" >&2; return 1; }
+    done
+    SOURCE_DIR=$(realpath -e -- "$source") || return 1
+    BACKUP_DIR=$(realpath -e -- "$destination") || return 1
+    [[ -d $SOURCE_DIR && -d $BACKUP_DIR && $SOURCE_DIR != / && $BACKUP_DIR != / ]] || return 1
+    [[ $BACKUP_DIR != "$SOURCE_DIR" && $BACKUP_DIR != "$SOURCE_DIR/"* ]] || {
+        echo 'Backup destination must be outside the source tree' >&2; return 1;
+    }
+    : "${EXPECTED_BACKUP_SOURCE:?Set EXPECTED_BACKUP_SOURCE to the reviewed findmnt SOURCE for this destination}"
+    actual=$(findmnt -n -o SOURCE -T "$BACKUP_DIR") || return 1
+    [[ $actual == "$EXPECTED_BACKUP_SOURCE" ]] || { echo 'Backup mount identity mismatch' >&2; return 1; }
+    [[ ! -L $destination ]] || { echo 'Symlink backup destinations are not supported' >&2; return 1; }
+    needed=$(du -sb -- "$SOURCE_DIR" | cut -f1) || return 1
+    available=$(df -B1 --output=avail -- "$BACKUP_DIR" | awk 'NR==2 {print $1}') || return 1
+    [[ $needed =~ ^[0-9]+$ && $available =~ ^[0-9]+$ ]] || return 1
+    (( available > needed + needed / 10 + 524288000 )) || { echo 'Insufficient backup headroom' >&2; return 1; }
+}
+publish_verified_archive() {
+    local partial=$1 target=$2 checksum
+    [[ ! -e $target && ! -L $target && ! -e ${target}.sha256 && ! -L ${target}.sha256 ]] || {
+        echo 'Refusing existing archive or checksum' >&2; return 1;
+    }
+    gzip -t -- "$partial" && tar -tzf "$partial" >/dev/null || return 1
+    checksum=$(mktemp "${target}.sha256.partial.XXXXXX") || return 1
+    # Hash through the final pathname only after no-clobber archive publication.
+    ln -T -- "$partial" "$target" || return 1
+    sha256sum -- "$target" > "$checksum" || return 1
+    ln -T -- "$checksum" "${target}.sha256" || return 1
+    rm -- "$partial" "$checksum" || return 1
+}
+create_verified_archive() {
+    local target=$1 partial
+    [[ ! -e $target && ! -L $target && ! -e ${target}.sha256 && ! -L ${target}.sha256 ]] || {
+        echo 'Refusing existing archive or checksum' >&2; return 1;
+    }
+    partial=$(mktemp "${target}.partial.XXXXXX") || return 1
+    if ! tar -czf "$partial" -C "$(dirname -- "$SOURCE_DIR")" -- "$(basename -- "$SOURCE_DIR")"; then
+        echo "Backup failed; incomplete artifact retained: $partial" >&2; return 1
+    fi
+    publish_verified_archive "$partial" "$target" || return 1
+    printf 'Verified archive: %s (restore test still required)\n' "$target"
+}
+preview_retention() {
+    local dir=$1 pattern=$2 days=$3
+    [[ $days =~ ^[1-9][0-9]*$ ]] || return 1
+    printf 'Retention candidates only; review before any separate deletion:\n'
+    find "$dir" -maxdepth 1 -type f -name "$pattern" -mtime "+$days" -print
+}
diff --git a/scripts/monitoring/cpu_memory_monitor b/scripts/monitoring/cpu_memory_monitor
index bf6115b..ca2c5ac 100644
--- a/scripts/monitoring/cpu_memory_monitor
+++ b/scripts/monitoring/cpu_memory_monitor
@@ -8,6 +8,7 @@
 # Version     : 2.0
 # ===========================================================
 set -euo pipefail
+umask 077
 
 SCRIPT_NAME="cpu_memory_monitor"
 LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
@@ -62,7 +63,7 @@ if [ "$CPU_USAGE" -ge "$CPU_THRESHOLD" ]; then
     log "🔴 CRITICAL: $MSG"
 
     # Top 3 CPU-hungry processes for context
-    TOP_PROCS=$(ps -eo comm,%cpu --sort=-%cpu | head -4 | tail -3 | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
+    TOP_PROCS=$(ps -eo comm,%cpu --sort=-%cpu | awk 'NR>=2 && NR<=4' | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
     alert_critical "$SCRIPT_NAME" "High CPU Usage — $HOST" "$MSG\nTop processes: $TOP_PROCS"
 else
     log "✅ CPU usage normal: ${CPU_USAGE}% (threshold: ${CPU_THRESHOLD}%)"
@@ -76,7 +77,7 @@ if [ "$MEM_INT" -ge "$MEM_THRESHOLD" ]; then
     MSG="Memory usage is at ${MEM_USAGE}% (${MEM_USED_MB}MB / ${MEM_TOTAL_MB}MB) on $HOST"
     log "🔴 CRITICAL: $MSG"
 
-    TOP_MEM=$(ps -eo comm,%mem --sort=-%mem | head -4 | tail -3 | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
+    TOP_MEM=$(ps -eo comm,%mem --sort=-%mem | awk 'NR>=2 && NR<=4' | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
     alert_critical "$SCRIPT_NAME" "High Memory Usage — $HOST" "$MSG\nTop processes: $TOP_MEM"
 else
     log "✅ Memory usage normal: ${MEM_USAGE}% — ${MEM_USED_MB}MB / ${MEM_TOTAL_MB}MB"
diff --git a/scripts/monitoring/disk_alert b/scripts/monitoring/disk_alert
index 7e26e5b..8f275fb 100644
--- a/scripts/monitoring/disk_alert
+++ b/scripts/monitoring/disk_alert
@@ -1,85 +1,29 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : disk_alert.sh
-# Purpose     : Monitor disk usage on all mountpoints
-#               Alert via Slack/Email when threshold exceeded
-# Usage       : ./disk_alert.sh
-#               Recommended cron: */30 * * * *
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# GNU df: one collection pass, preserving the trailing mountpoint field.
 set -euo pipefail
-
-SCRIPT_NAME="disk_alert"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-WARNING_THRESHOLD=75    # % — send WARNING alert
-CRITICAL_THRESHOLD=90   # % — send CRITICAL alert
-
-# Mountpoints to skip (space-separated)
-EXCLUDE_FS="tmpfs devtmpfs udev squashfs overlay"
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-ALERT_TRIGGERED=false
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "--- Disk usage check started on $HOST ---"
-
-# Build exclusion pattern
-EXCLUDE_PATTERN=$(echo "$EXCLUDE_FS" | tr ' ' '|')
-
-while IFS= read -r line; do
-    # Parse df output columns
-    FS=$(echo "$line"      | awk '{print $1}')
-    SIZE=$(echo "$line"    | awk '{print $2}')
-    USED=$(echo "$line"    | awk '{print $3}')
-    AVAIL=$(echo "$line"   | awk '{print $4}')
-    USEP=$(echo "$line"    | awk '{print $5}' | tr -d '%')
-    MOUNT=$(echo "$line"   | awk '{print $6}')
-
-    # Skip excluded filesystem types
-    FS_TYPE=$(findmnt -n -o FSTYPE "$MOUNT" 2>/dev/null || echo "unknown")
-    if echo "$FS_TYPE" | grep -qE "^($EXCLUDE_PATTERN)$"; then
-        continue
-    fi
-
-    # Skip if usage is not a number
-    if ! [[ "$USEP" =~ ^[0-9]+$ ]]; then
-        continue
-    fi
-
-    if [ "$USEP" -ge "$CRITICAL_THRESHOLD" ]; then
-        MSG="CRITICAL: $MOUNT on $HOST is ${USEP}% full (Used: $USED / $SIZE, Available: $AVAIL)"
-        log "🔴 $MSG"
-        alert_critical "$SCRIPT_NAME" "Disk Critical — $MOUNT on $HOST" "$MSG"
-        ALERT_TRIGGERED=true
-
-    elif [ "$USEP" -ge "$WARNING_THRESHOLD" ]; then
-        MSG="WARNING: $MOUNT on $HOST is ${USEP}% full (Used: $USED / $SIZE, Available: $AVAIL)"
-        log "🟡 $MSG"
-        alert_warning "$SCRIPT_NAME" "Disk Warning — $MOUNT on $HOST" "$MSG"
-        ALERT_TRIGGERED=true
-
+lock_script disk_alert
+WARNING_THRESHOLD=${WARNING_THRESHOLD:-75}
+CRITICAL_THRESHOLD=${CRITICAL_THRESHOLD:-90}
+[[ $WARNING_THRESHOLD =~ ^[0-9]+$ && $CRITICAL_THRESHOLD =~ ^[0-9]+$ ]] || exit 2
+(( WARNING_THRESHOLD < CRITICAL_THRESHOLD && CRITICAL_THRESHOLD <= 100 )) || exit 2
+data=$(LC_ALL=C df -BM --output=fstype,size,used,avail,pcent,target) || {
+    alert_critical disk_alert UNKNOWN 'Filesystem collection failed'; exit 1;
+}
+checked=0 failed=0
+while read -r type size used avail percent mount; do
+    case $type in Type|tmpfs|devtmpfs|udev|squashfs|overlay) continue ;; esac
+    percent=${percent%%%}
+    [[ $percent =~ ^[0-9]+$ && -n $mount ]] || { echo 'UNKNOWN: malformed df row' >&2; failed=1; continue; }
+    checked=$((checked + 1))
+    if (( percent >= CRITICAL_THRESHOLD )); then
+        alert_critical disk_alert "$mount" "${percent}% used; $avail available"; failed=1
+    elif (( percent >= WARNING_THRESHOLD )); then
+        alert_warning disk_alert "$mount" "${percent}% used; $avail available"; failed=1
     else
-        log "✅ $MOUNT — ${USEP}% used (${AVAIL} free)"
+        printf 'OK: %s %s%% used\n' "$mount" "$percent"
     fi
-
-done < <(df -BM | awk 'NR>1')
-
-if [ "$ALERT_TRIGGERED" = false ]; then
-    log "✅ All disk partitions within normal range."
-fi
-
-log "--- Disk usage check completed ---"
+done <<< "$data"
+(( checked > 0 )) || { echo 'UNKNOWN: no eligible filesystems checked' >&2; exit 1; }
+(( failed == 0 ))
diff --git a/scripts/monitoring/healthcare_check.sh b/scripts/monitoring/healthcare_check.sh
index a7a842a..59f03a7 100644
--- a/scripts/monitoring/healthcare_check.sh
+++ b/scripts/monitoring/healthcare_check.sh
@@ -1,115 +1,62 @@
 #!/usr/bin/env bash
-#
-# healthcheck.sh
-#
-# Read-only system health check for RHEL/CentOS (and most Linux) servers.
-# Reports on CPU load, memory usage, disk usage, and swap — no changes made
-# to the system. Exits non-zero if any metric crosses its threshold, so it
-# can be wired into cron + alerting without extra glue code.
-#
-# author blow_tech
-# Usage:
-#   ./healthcheck.sh [--cpu-threshold N] [--mem-threshold N] [--disk-threshold N]
-#
-# Options:
-#   --cpu-threshold N     Load average (1-min, normalized per core) alert threshold. Default: 0.85
-#   --disk-threshold N    Disk usage percentage alert threshold. Default: 90
-#   --mem-threshold N     Memory usage percentage alert threshold. Default: 90
-#   -h, --help            Show this help message
-#
-# Exit codes:
-#   0  All checks within thresholds
-#   1  One or more checks exceeded thresholds
-#   2  Invalid usage
-#
-# Requires: bash, coreutils (df, free, uptime, nproc) — all standard, no root required.
-
+# Read-only health checks. Usage: healthcare_check.sh [--cpu-threshold N] [--mem-threshold N] [--disk-threshold N]
+# Exit: 0 healthy, 1 threshold exceeded, 2 invalid usage, 3 incomplete collection.
 set -euo pipefail
-
-CPU_THRESHOLD=0.85
-DISK_THRESHOLD=90
-MEM_THRESHOLD=90
-ISSUES=0
-
-usage() {
-    grep '^#' "$0" | sed -e 's/^#//' -e '1d'
-    exit 2
-}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --cpu-threshold) CPU_THRESHOLD="$2"; shift 2 ;;
-        --disk-threshold) DISK_THRESHOLD="$2"; shift 2 ;;
-        --mem-threshold) MEM_THRESHOLD="$2"; shift 2 ;;
-        -h|--help) usage ;;
-        *) echo "Unknown option: $1" >&2; usage ;;
+export LC_ALL=C
+CPU_THRESHOLD=0.85 DISK_THRESHOLD=90 MEM_THRESHOLD=90 ISSUES=0
+usage() { echo 'Usage: healthcare_check.sh [--cpu-threshold N] [--mem-threshold N] [--disk-threshold N]'; }
+unknown() { echo "STATUS: UNKNOWN — $*" >&2; exit 3; }
+bad_usage() { echo "Error: $*" >&2; usage >&2; exit 2; }
+while (( $# )); do
+    case $1 in
+        --cpu-threshold|--disk-threshold|--mem-threshold)
+            (( $# >= 2 )) || bad_usage "Missing value for $1"
+            case $1 in
+                --cpu-threshold) CPU_THRESHOLD=$2 ;;
+                --disk-threshold) DISK_THRESHOLD=$2 ;;
+                --mem-threshold) MEM_THRESHOLD=$2 ;;
+            esac
+            shift 2 ;;
+        -h|--help) usage; exit 0 ;;
+        *) bad_usage "Unknown option: $1" ;;
     esac
 done
-
-echo "=== Health Check: $(hostname) — $(date '+%Y-%m-%d %H:%M:%S') ==="
-
-# --- CPU load ---
-CORES=$(nproc)
-LOAD_1M=$(cut -d' ' -f1 /proc/loadavg)
-LOAD_NORMALIZED=$(awk -v l="$LOAD_1M" -v c="$CORES" 'BEGIN { printf "%.2f", l / c }')
-
-echo "--- CPU ---"
-echo "Cores: ${CORES}"
-echo "Load average (1m): ${LOAD_1M} (normalized: ${LOAD_NORMALIZED})"
-if awk -v n="$LOAD_NORMALIZED" -v t="$CPU_THRESHOLD" 'BEGIN { exit !(n > t) }'; then
-    echo "STATUS: WARNING — normalized load ${LOAD_NORMALIZED} exceeds threshold ${CPU_THRESHOLD}"
-    ISSUES=$((ISSUES + 1))
-else
-    echo "STATUS: OK"
-fi
-
-# --- Memory ---
-echo "--- Memory ---"
-read -r MEM_TOTAL MEM_USED <<< "$(free -m | awk '/^Mem:/ {print $2, $3}')"
-MEM_PCT=$(awk -v u="$MEM_USED" -v t="$MEM_TOTAL" 'BEGIN { printf "%.0f", (u/t)*100 }')
-echo "Used: ${MEM_USED}MB / ${MEM_TOTAL}MB (${MEM_PCT}%)"
-if [[ "$MEM_PCT" -ge "$MEM_THRESHOLD" ]]; then
-    echo "STATUS: WARNING — memory usage ${MEM_PCT}% exceeds threshold ${MEM_THRESHOLD}%"
-    ISSUES=$((ISSUES + 1))
-else
-    echo "STATUS: OK"
+[[ $CPU_THRESHOLD =~ ^[0-9]{1,6}(\.[0-9]{1,6})?$ ]] || bad_usage 'Invalid CPU threshold'
+for n in "$MEM_THRESHOLD" "$DISK_THRESHOLD"; do
+    [[ $n =~ ^[0-9]{1,3}$ ]] && (( 10#$n >= 1 && 10#$n <= 100 )) || bad_usage 'Percentage thresholds must be 1–100'
+done
+MEM_THRESHOLD=$((10#$MEM_THRESHOLD)); DISK_THRESHOLD=$((10#$DISK_THRESHOLD))
+CORES=$(timeout 30 nproc) || unknown 'CPU core collection failed'
+LOAD_1M=$(cut -d' ' -f1 /proc/loadavg) || unknown 'Load collection failed'
+[[ $CORES =~ ^[1-9][0-9]*$ && $LOAD_1M =~ ^[0-9]+(\.[0-9]+)?$ ]] || unknown 'Malformed CPU data'
+echo "CPU: load=$LOAD_1M cores=$CORES threshold=$CPU_THRESHOLD per core"
+if awk -v l="$LOAD_1M" -v c="$CORES" -v t="$CPU_THRESHOLD" 'BEGIN {exit !(l/c > t)}'; then
+    echo 'STATUS: WARNING — CPU load exceeded threshold'; ISSUES=$((ISSUES+1))
 fi
-
-# --- Swap ---
-echo "--- Swap ---"
-read -r SWAP_TOTAL SWAP_USED <<< "$(free -m | awk '/^Swap:/ {print $2, $3}')"
-if [[ "$SWAP_TOTAL" -eq 0 ]]; then
-    echo "No swap configured"
-else
-    SWAP_PCT=$(awk -v u="$SWAP_USED" -v t="$SWAP_TOTAL" 'BEGIN { printf "%.0f", (u/t)*100 }')
-    echo "Used: ${SWAP_USED}MB / ${SWAP_TOTAL}MB (${SWAP_PCT}%)"
+# Collect memory and swap once; never turn missing rows into zero usage.
+MEMORY=$(timeout 30 free -m) || unknown 'Memory collection failed'
+read -r MEM_TOTAL MEM_USED <<< "$(awk '/^Mem:/ {print $2, $3}' <<< "$MEMORY")"
+read -r SWAP_TOTAL SWAP_USED <<< "$(awk '/^Swap:/ {print $2, $3}' <<< "$MEMORY")"
+for n in "$MEM_TOTAL" "$MEM_USED" "$SWAP_TOTAL" "$SWAP_USED"; do
+    [[ $n =~ ^(0|[1-9][0-9]*)$ ]] || unknown 'Missing or malformed memory/swap row'
+done
+(( MEM_TOTAL > 0 && MEM_USED <= MEM_TOTAL && SWAP_USED <= SWAP_TOTAL )) || unknown 'Inconsistent memory/swap totals'
+echo "Memory: $MEM_USED/$MEM_TOTAL MiB; swap: $SWAP_USED/$SWAP_TOTAL MiB"
+if awk -v u="$MEM_USED" -v t="$MEM_TOTAL" -v limit="$MEM_THRESHOLD" 'BEGIN {exit !(100*u/t >= limit)}'; then
+    echo 'STATUS: WARNING — memory usage exceeded threshold'; ISSUES=$((ISSUES+1))
 fi
-
-# --- Disk ---
-echo "--- Disk ---"
-DISK_ISSUE=0
-while read -r LINE; do
-    USE_PCT=$(echo "$LINE" | awk '{print $5}' | tr -d '%')
-    MOUNT=$(echo "$LINE" | awk '{print $6}')
-    FS=$(echo "$LINE" | awk '{print $1}')
-    echo "${MOUNT} (${FS}): ${USE_PCT}% used"
-    if [[ "$USE_PCT" -ge "$DISK_THRESHOLD" ]]; then
-        echo "  STATUS: WARNING — exceeds threshold ${DISK_THRESHOLD}%"
-        DISK_ISSUE=1
+DISKS=$(timeout 30 df -hP -x tmpfs -x devtmpfs) || unknown 'Filesystem collection failed'
+CHECKED=0
+while read -r fs size used avail percent mount; do
+    [[ $fs == Filesystem ]] && continue
+    percent=${percent%%%}
+    [[ $percent =~ ^(0|[1-9][0-9]*)$ && -n $mount ]] || unknown 'Missing or malformed filesystem row'
+    CHECKED=$((CHECKED+1))
+    printf '%s (%s): %s%% used\n' "$mount" "$fs" "$percent"
+    if (( percent >= DISK_THRESHOLD )); then
+        echo 'STATUS: WARNING — disk usage exceeded threshold'; ISSUES=$((ISSUES+1))
     fi
-done < <(df -hP -x tmpfs -x devtmpfs | tail -n +2)
-
-if [[ "$DISK_ISSUE" -eq 1 ]]; then
-    ISSUES=$((ISSUES + 1))
-else
-    echo "STATUS: OK (all filesystems)"
-fi
-
-echo "=== Summary ==="
-if [[ "$ISSUES" -eq 0 ]]; then
-    echo "All checks passed."
-    exit 0
-else
-    echo "${ISSUES} check(s) exceeded threshold. Review output above."
-    exit 1
-fi
+done <<< "$DISKS"
+(( CHECKED > 0 )) || unknown 'No eligible filesystems were checked'
+if (( ISSUES )); then echo "$ISSUES threshold(s) exceeded."; exit 1; fi
+echo 'All checks passed.'
diff --git a/scripts/monitoring/log_summary.sh b/scripts/monitoring/log_summary.sh
index ae1d9ef..c3bb494 100644
--- a/scripts/monitoring/log_summary.sh
+++ b/scripts/monitoring/log_summary.sh
@@ -1,106 +1,76 @@
 #!/usr/bin/env bash
-#
-# log-summary.sh
-#
-# Read-only log analysis tool. Scans a log file (including rotated .gz
-# archives) for error/warning/critical patterns and prints a frequency
-# summary. Makes no changes to any file — safe to run against live logs.
-#
-# author blow_tech
-# Usage:
-#   ./log-summary.sh -f /var/log/messages [-p "error|fail|critical"] [-n 10]
-#   ./log-summary.sh -f /var/log/messages --include-rotated
-#
-# Options:
-#   -f, --file PATH         Log file to analyze (required)
-#   -p, --pattern REGEX     Extended regex pattern to match (default: error|warn|fail|critical|denied)
-#   -n, --top N             Show top N most frequent matching lines (default: 15)
-#   --include-rotated       Also scan rotated logs matching PATH.1, PATH.2.gz, etc.
-#   -h, --help              Show this help message
-#
-# Exit codes:
-#   0  Completed (matches may or may not have been found)
-#   2  Invalid usage or file not found/readable
-#
-# Requires: bash, grep, zgrep, awk, sort. Read access to the target log
-# file(s) — no write or execute permissions needed on the logs themselves.
-
+# Read-only log analysis. Input errors never become successful empty reports.
+# Exit: 0 complete (including no matches), 2 usage, 3 incomplete/error/timeout.
 set -euo pipefail
-
-PATTERN='error|warn|fail|critical|denied'
-TOP_N=15
-INCLUDE_ROTATED=0
-LOGFILE=""
-
-usage() {
-    grep '^#' "$0" | sed -e 's/^#//' -e '1d'
-    exit 2
-}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        -f|--file) LOGFILE="$2"; shift 2 ;;
-        -p|--pattern) PATTERN="$2"; shift 2 ;;
-        -n|--top) TOP_N="$2"; shift 2 ;;
+export LC_ALL=C
+PATTERN='error|warn|fail|critical|denied' TOP_N=15 INCLUDE_ROTATED=0 LOGFILE='' SCAN_TIMEOUT=60
+usage() { echo 'Usage: log_summary.sh -f FILE [-p REGEX] [-n TOP] [--include-rotated] [--timeout SECONDS]'; }
+bad_usage() { echo "Error: $*" >&2; usage >&2; exit 2; }
+unknown() { echo "STATUS: UNKNOWN — $*" >&2; exit 3; }
+while (( $# )); do
+    case $1 in
+        -f|--file|-p|--pattern|-n|--top|--timeout)
+            (( $# >= 2 )) || bad_usage "Missing value for $1"
+            case $1 in
+                -f|--file) LOGFILE=$2 ;;
+                -p|--pattern) PATTERN=$2 ;;
+                -n|--top) TOP_N=$2 ;;
+                --timeout) SCAN_TIMEOUT=$2 ;;
+            esac
+            shift 2 ;;
         --include-rotated) INCLUDE_ROTATED=1; shift ;;
-        -h|--help) usage ;;
-        *) echo "Unknown option: $1" >&2; usage ;;
+        -h|--help) usage; exit 0 ;;
+        *) bad_usage "Unknown option: $1" ;;
     esac
 done
-
-if [[ -z "$LOGFILE" ]]; then
-    echo "Error: -f/--file is required" >&2
-    usage
-fi
-
-if [[ ! -r "$LOGFILE" ]]; then
-    echo "Error: cannot read '$LOGFILE' (check path and permissions)" >&2
-    exit 2
-fi
-
-echo "=== Log Summary: ${LOGFILE} — $(date '+%Y-%m-%d %H:%M:%S') ==="
-echo "Pattern: ${PATTERN}"
-echo
-
-TMP_MATCHES=$(mktemp)
-trap 'rm -f "$TMP_MATCHES"' EXIT
-
-# Current log
-grep -Ei "$PATTERN" "$LOGFILE" >> "$TMP_MATCHES" || true
-
-# Rotated logs (plain and gzip), read-only
-if [[ "$INCLUDE_ROTATED" -eq 1 ]]; then
-    for f in "${LOGFILE}".*; do
-        [[ -e "$f" ]] || continue
-        case "$f" in
-            *.gz) zgrep -Ei "$PATTERN" "$f" >> "$TMP_MATCHES" || true ;;
-            *)    grep -Ei "$PATTERN" "$f"  >> "$TMP_MATCHES" || true ;;
-        esac
+[[ $TOP_N =~ ^[1-9][0-9]{0,3}$ ]] || bad_usage 'TOP must be 1–9999'
+[[ $SCAN_TIMEOUT =~ ^[1-9][0-9]{0,4}$ ]] || bad_usage 'Timeout must be 1–99999 seconds per file'
+[[ -n $LOGFILE && -f $LOGFILE && -r $LOGFILE ]] || bad_usage 'A readable regular log file is required'
+rc=0; grep -Ei -- "$PATTERN" /dev/null >/dev/null || rc=$?
+(( rc <= 1 )) || bad_usage 'Invalid extended regular expression'
+umask 077
+WORK=$(mktemp -d) || unknown 'Cannot allocate private temporary directory'
+trap 'rm -rf -- "$WORK"' EXIT
+MATCHES=$WORK/matches
+: > "$MATCHES"
+scan_file() {
+    local file=$1 rc=0
+    local -a statuses
+    [[ -f $file && -r $file ]] || unknown "Cannot read regular file: $file"
+    case $file in
+        *.gz)
+            # zgrep may silently read non-gzip input as plaintext. Require a
+            # successful decompressor as well as grep's success/no-match status.
+            if timeout --kill-after=5 "$SCAN_TIMEOUT" gzip -cd -- "$file" |
+                timeout --kill-after=5 "$SCAN_TIMEOUT" grep -Ei -- "$PATTERN" >> "$MATCHES"; then
+                statuses=("${PIPESTATUS[@]}")
+            else
+                statuses=("${PIPESTATUS[@]}")
+            fi
+            (( statuses[0] == 0 && statuses[1] <= 1 )) || unknown "Compressed scan failed for $file (exits ${statuses[*]}); report is incomplete"
+            ;;
+        *) timeout --kill-after=5 "$SCAN_TIMEOUT" grep -Ei -- "$PATTERN" "$file" >> "$MATCHES" || rc=$? ;;
+    esac
+    (( rc <= 1 )) || unknown "Scan failed for $file (exit $rc); report is incomplete"
+}
+scan_file "$LOGFILE"
+if (( INCLUDE_ROTATED )); then
+    for file in "$LOGFILE".*; do
+        suffix=${file#"$LOGFILE".}
+        [[ $suffix =~ ^[0-9]+(\.gz)?$ ]] || continue
+        [[ -e $file || -L $file ]] || continue
+        scan_file "$file"
     done
 fi
-
-TOTAL_MATCHES=$(wc -l < "$TMP_MATCHES" | tr -d ' ')
-echo "Total matching lines: ${TOTAL_MATCHES}"
-echo
-
-if [[ "$TOTAL_MATCHES" -eq 0 ]]; then
-    echo "No matches found for the given pattern."
-    exit 0
-fi
-
-echo "--- Top ${TOP_N} most frequent matching lines (normalized) ---"
-# Strip leading timestamps/PIDs heuristically so similar events group together,
-# then rank by frequency. This is a best-effort normalization, not exact parsing.
-awk '{ $1=""; $2=""; $3=""; print }' "$TMP_MATCHES" \
-    | sed -E 's/[0-9]+/#/g' \
-    | sort \
-    | uniq -c \
-    | sort -rn \
-    | head -n "$TOP_N"
-
-echo
-echo "--- Matches per severity keyword ---"
-for kw in error warn fail critical denied; do
-    COUNT=$(grep -ci "$kw" "$TMP_MATCHES" || true)
-    printf "%-10s %s\n" "$kw" "$COUNT"
+TOTAL_MATCHES=$(wc -l < "$MATCHES")
+echo "Total matching lines: $TOTAL_MATCHES"
+if (( TOTAL_MATCHES == 0 )); then echo 'No matches found for the given pattern.'; exit 0; fi
+echo "--- Top $TOP_N most frequent matching lines (heuristic normalization) ---"
+# Consume sorted input fully; head can cause a spurious SIGPIPE under pipefail.
+awk '{ $1=""; $2=""; $3=""; print }' "$MATCHES" | sed -E 's/[0-9]+/#/g' | sort | uniq -c | sort -rn | sed -n "1,${TOP_N}p"
+echo '--- Matches per severity keyword ---'
+for keyword in error warn fail critical denied; do
+    rc=0; count=$(grep -ci -- "$keyword" "$MATCHES") || rc=$?
+    (( rc <= 1 )) || unknown 'Cannot read collected matches'
+    printf '%-10s %s\n' "$keyword" "$count"
 done
diff --git a/scripts/monitoring/service_uptime b/scripts/monitoring/service_uptime
index 517f426..1fea851 100644
--- a/scripts/monitoring/service_uptime
+++ b/scripts/monitoring/service_uptime
@@ -1,83 +1,28 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : service_uptime_checker.sh
-# Purpose     : Check critical services — restart if down,
-#               escalate alert if restart fails
-# Usage       : ./service_uptime_checker.sh
-#               Recommended cron: */5 * * * *
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# Alert-only monitor. Supply intended service names explicitly.
 set -euo pipefail
-
-SCRIPT_NAME="service_uptime_checker"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-SERVICES=("nginx" "docker" "mysql")   # Services to monitor
-MAX_RESTART_ATTEMPTS=2                  # How many times to retry before escalating
-RESTART_WAIT=5                          # Seconds to wait between restart attempts
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-FAIL_COUNT=0
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "--- Service check started on $HOST ---"
-
-for service in "${SERVICES[@]}"; do
-
-    # Check if service exists on this system
-    if ! systemctl list-units --full --all 2>/dev/null | grep -q "^${service}.service"; then
-        log "⏭️  $service — not installed on this system, skipping."
-        continue
+[[ $# -gt 0 ]] || { echo 'Usage: service_uptime <service> [service ...]' >&2; exit 2; }
+lock_script service_uptime
+checked=0 failed=0
+for service in "$@"; do
+    [[ $service =~ ^[a-zA-Z0-9_@.:-]+$ ]] || { echo 'Invalid unit name' >&2; exit 2; }
+    checked=$((checked + 1))
+    if ! state=$(systemctl show "$service" --property=LoadState,ActiveState --no-pager); then
+        alert_critical service_uptime 'UNKNOWN: query failed' "$service"
+        failed=$((failed + 1)); continue
     fi
-
-    if systemctl is-active --quiet "$service"; then
-        log "✅ $service is running."
+    load= active=
+    while IFS='=' read -r key value; do
+        case $key in LoadState) load=$value ;; ActiveState) active=$value ;; esac
+    done <<< "$state"
+    if [[ $load == loaded && $active == active ]]; then
+        printf 'OK: %s\n' "$service"
     else
-        log "⚠️  $service is DOWN — attempting restart..."
-        alert_warning "$SCRIPT_NAME" "Service Down — $service on $HOST" \
-            "$service is not running on $HOST. Attempting automatic restart."
-
-        SUCCESS=false
-        for attempt in $(seq 1 "$MAX_RESTART_ATTEMPTS"); do
-            log "   Restart attempt $attempt / $MAX_RESTART_ATTEMPTS ..."
-            systemctl restart "$service" 2>>"$LOG_FILE" || true
-            sleep "$RESTART_WAIT"
-
-            if systemctl is-active --quiet "$service"; then
-                log "✅ $service restarted successfully on attempt $attempt."
-                alert_info "$SCRIPT_NAME" "Service Recovered — $service on $HOST" \
-                    "$service was down but has been restarted successfully on attempt $attempt."
-                SUCCESS=true
-                break
-            fi
-        done
-
-        if [ "$SUCCESS" = false ]; then
-            log "🔴 CRITICAL: $service failed to restart after $MAX_RESTART_ATTEMPTS attempts! Manual intervention required."
-            alert_critical "$SCRIPT_NAME" "Service FAILED — $service on $HOST" \
-                "$service could not be restarted after $MAX_RESTART_ATTEMPTS attempts on $HOST. MANUAL INTERVENTION REQUIRED.\n\nLast journal entries:\n$(journalctl -u "$service" -n 10 --no-pager 2>/dev/null || echo 'Unable to fetch journal')"
-            (( FAIL_COUNT++ )) || true
-        fi
+        alert_critical service_uptime 'Service not healthy' "$service load=$load active=$active; no restart attempted"
+        failed=$((failed + 1))
     fi
 done
-
-if [ "$FAIL_COUNT" -gt 0 ]; then
-    log "--- Service check completed with $FAIL_COUNT failure(s) ---"
-    exit 1
-else
-    log "--- Service check completed — all services healthy ---"
-    exit 0
-fi
+printf 'Checked=%s Failed=%s\n' "$checked" "$failed"
+(( failed == 0 ))
diff --git a/tests/test_collection.py b/tests/test_collection.py
new file mode 100644
index 0000000..e2185bd
--- /dev/null
+++ b/tests/test_collection.py
@@ -0,0 +1,99 @@
+"""Disposable inputs and mocked collectors only; no operational targets."""
+import gzip
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+ROOT = Path(__file__).resolve().parents[1]
+class CollectionTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp=tempfile.TemporaryDirectory(); self.addCleanup(self.tmp.cleanup)
+        self.base=Path(self.tmp.name); self.bin=self.base/'bin'; self.bin.mkdir()
+        self.env=dict(os.environ,PATH=str(self.bin)+os.pathsep+os.environ['PATH'])
+    def mock(self,name,body):
+        p=self.bin/name;p.write_text('#!/usr/bin/env bash\n'+body+'\n');p.chmod(0o755)
+    def run_script(self,path,*args):
+        return subprocess.run(['bash',str(ROOT/'scripts'/path),*map(str,args)],env=self.env,text=True,capture_output=True,timeout=15)
+    def healthy(self):
+        self.mock('nproc','echo 2');self.mock('cut','echo 0.10')
+        self.mock('free',"printf 'Mem: 1000 100 900 0 0 900\\nSwap: 0 0 0\\n'")
+        self.mock('df',"printf 'Filesystem Size Used Avail Use%% Mounted on\\n/dev/fake 100G 1G 99G 1%% /data with spaces\\n'")
+    def test_health_healthy_and_spaces(self):
+        self.healthy();p=self.run_script('monitoring/healthcare_check.sh')
+        self.assertEqual(p.returncode,0,p.stderr);self.assertIn('/data with spaces',p.stdout)
+    def test_health_failed_collectors(self):
+        for collector in ['nproc','free','df']:
+            with self.subTest(collector=collector):
+                self.healthy();self.mock(collector,'exit 1');p=self.run_script('monitoring/healthcare_check.sh')
+                self.assertEqual(p.returncode,3,p.stderr);self.assertNotIn('All checks passed',p.stdout)
+    def test_health_malformed_or_empty_evidence(self):
+        for collector,body in [('df','echo "Filesystem Size Used Avail Use% Mounted on"'),('df','echo invalid'),('free','echo invalid'),('nproc','echo 0')]:
+            with self.subTest(collector=collector,body=body):
+                self.healthy();self.mock(collector,body)
+                self.assertEqual(self.run_script('monitoring/healthcare_check.sh').returncode,3)
+    def test_health_high_disk(self):
+        self.healthy();self.mock('df',"printf 'Filesystem Size Used Avail Use%% Mounted on\\n/dev/fake 100G 99G 1G 99%% /data\\n'")
+        self.assertEqual(self.run_script('monitoring/healthcare_check.sh').returncode,1)
+    def test_health_memory_collected_once(self):
+        self.healthy();counter=self.base/'calls';self.env['CALLS']=str(counter)
+        self.mock('free',"echo called >> \"$CALLS\"; printf 'Mem: 1000 100 900 0 0 900\\nSwap: 0 0 0\\n'")
+        self.assertEqual(self.run_script('monitoring/healthcare_check.sh').returncode,0)
+        self.assertEqual(counter.read_text().splitlines(),['called'])
+    def test_health_usage(self):
+        self.healthy()
+        self.assertEqual(self.run_script('monitoring/healthcare_check.sh','--disk-threshold','08').returncode,0)
+        for args in [('--disk-threshold',),('--mem-threshold','-1'),('--cpu-threshold','nan'),('--disk-threshold','101')]:
+            self.assertEqual(self.run_script('monitoring/healthcare_check.sh',*args).returncode,2)
+    def test_backup_age_boundary_and_future(self):
+        backup=self.base/'backup.bin';backup.write_text('backup');now=1800000000;self.mock('date',f'echo {now}')
+        for age,expected in [(86400,0),(86401,1),(88200,1),(-10,3)]:
+            os.utime(backup,(now-age,now-age));p=self.run_script('backup/backup_verify.sh','-d',self.base,'-m','24')
+            self.assertEqual(p.returncode,expected,p.stdout+p.stderr)
+    def test_backup_newline_filename(self):
+        (self.base/'backup\nsecond line.bin').write_text('backup')
+        self.assertEqual(self.run_script('backup/backup_verify.sh','-d',self.base).returncode,0)
+    def test_backup_collection_failure_and_unsupported_integrity(self):
+        (self.base/'backup.bin').write_text('backup')
+        p=self.run_script('backup/backup_verify.sh','-d',self.base,'--verify-archive')
+        self.assertEqual(p.returncode,3);self.assertNotIn('verification passed',p.stdout)
+        self.mock('find','exit 1');self.assertEqual(self.run_script('backup/backup_verify.sh','-d',self.base).returncode,3)
+    def test_backup_valid_and_corrupt_archive(self):
+        (self.base/'source').write_text('preserved');archive=self.base/'backup.tar.gz'
+        subprocess.run(['tar','-czf',str(archive),'-C',str(self.base),'source'],check=True)
+        args=('-d',self.base,'--pattern','*.tar.gz','--verify-archive')
+        self.assertEqual(self.run_script('backup/backup_verify.sh',*args).returncode,0)
+        archive.write_text('corrupt');self.assertEqual(self.run_script('backup/backup_verify.sh',*args).returncode,1)
+    def test_backup_usage_and_empty_directory(self):
+        for args in [('-d',),('-d',self.base,'-m','x'),('-d',self.base,'-m','-1')]:
+            self.assertEqual(self.run_script('backup/backup_verify.sh',*args).returncode,2)
+        self.assertEqual(self.run_script('backup/backup_verify.sh','-d',self.base).returncode,1)
+    def test_log_invalid_regex_and_no_matches(self):
+        log=self.base/'app.log';log.write_text('normal operation\n')
+        p=self.run_script('monitoring/log_summary.sh','-f',log,'-p','[')
+        self.assertEqual(p.returncode,2);self.assertNotIn('No matches',p.stdout)
+        p=self.run_script('monitoring/log_summary.sh','-f',log)
+        self.assertEqual(p.returncode,0,p.stderr);self.assertIn('No matches',p.stdout)
+    def test_log_rotations_and_corrupt_gzip(self):
+        log=self.base/'app.log';log.write_text('Jan 01 00:00 error one\n')
+        (self.base/'app.log.1').write_text('Jan 01 00:00 error two\n')
+        with gzip.open(self.base/'app.log.2.gz','wt') as f:f.write('Jan 01 00:00 error three\n')
+        (self.base/'app.log.unrelated').write_text('error ignored\n')
+        args=('-f',log,'--include-rotated');p=self.run_script('monitoring/log_summary.sh',*args)
+        self.assertEqual(p.returncode,0,p.stderr);self.assertIn('Total matching lines: 3',p.stdout)
+        (self.base/'app.log.2.gz').write_bytes(b'not gzip');p=self.run_script('monitoring/log_summary.sh',*args)
+        self.assertEqual(p.returncode,3,p.stderr)
+    def test_log_read_failure_or_timeout(self):
+        log=self.base/'app.log';log.write_text('error\n')
+        for status in [2,124]:
+            self.mock('timeout',f'exit {status}');p=self.run_script('monitoring/log_summary.sh','-f',log)
+            self.assertEqual(p.returncode,3);self.assertNotIn('No matches',p.stdout)
+    def test_log_large_summary_no_sigpipe(self):
+        log=self.base/'app.log'
+        log.write_text(''.join('Jan 01 00:00 error '+chr(65+i//100)+chr(65+i%100)+'x'*80+'\n' for i in range(5000)))
+        self.assertEqual(self.run_script('monitoring/log_summary.sh','-f',log,'-n','1').returncode,0)
+    def test_help_and_missing_argument(self):
+        for path in ['backup/backup_verify.sh','monitoring/log_summary.sh','monitoring/healthcare_check.sh']:
+            self.assertEqual(self.run_script(path,'--help').returncode,0)
+        self.assertEqual(self.run_script('monitoring/log_summary.sh','-f').returncode,2)
+if __name__=='__main__':unittest.main()
diff --git a/tests/test_safety.py b/tests/test_safety.py
new file mode 100644
index 0000000..532a6c3
--- /dev/null
+++ b/tests/test_safety.py
@@ -0,0 +1,117 @@
+"""Local fixtures and mocked systemctl/df only. Never contacts a target or service."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+class SafetyTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.base = Path(self.tmp.name)
+        self.bin = self.base / 'bin'; self.bin.mkdir()
+        self.env = dict(os.environ, ADMIN_SCRIPTS_STATE_DIR=str(self.base/'state'), PATH=str(self.bin)+os.pathsep+os.environ['PATH'])
+    def mock(self, name, body):
+        p=self.bin/name; p.write_text('#!/usr/bin/env bash\n'+body+'\n'); p.chmod(0o755)
+    def run_script(self, script, *args):
+        return subprocess.run(['bash', str(ROOT/'scripts'/script), *map(str,args)], env=self.env, text=True, capture_output=True, timeout=15)
+    def backup_fixture(self):
+        source=self.base/'source with spaces'; source.mkdir(); (source/'data.txt').write_text('preserve me\n')
+        dest=self.base/'backups'; dest.mkdir()
+        self.env['EXPECTED_BACKUP_SOURCE']=subprocess.check_output(['findmnt','-n','-o','SOURCE','-T',str(dest)],text=True).strip()
+        return source,dest
+    def test_all_bash_syntax(self):
+        for p in (ROOT/'scripts').rglob('*'):
+            if p.is_file() and p.read_bytes().startswith(b'#!'):
+                result=subprocess.run(['bash','-n',str(p)],capture_output=True,text=True)
+                self.assertEqual(result.returncode,0,f'{p}: {result.stderr}')
+    def test_backup_roundtrip_and_preserves_unrelated_files(self):
+        src,dest=self.backup_fixture(); old=dest/'unrelated.tar.gz'; old.write_text('keep')
+        result=self.run_script('backup/backup_script',src,dest)
+        self.assertEqual(result.returncode,0,result.stderr)
+        archives=list(dest.glob('admin-backup-*.tar.gz')); self.assertEqual(len(archives),1)
+        restore=self.base/'restore'; restore.mkdir()
+        subprocess.run(['tar','-xzf',str(archives[0]),'-C',str(restore)],check=True)
+        self.assertEqual((restore/src.name/'data.txt').read_bytes(),(src/'data.txt').read_bytes())
+        self.assertEqual(old.read_text(),'keep')
+        subprocess.run(['sha256sum','-c',str(archives[0])+'.sha256'],check=True,capture_output=True)
+    def test_failed_tar_never_publishes_or_rotates(self):
+        src,dest=self.backup_fixture(); old=dest/'old.tar.gz'; old.write_text('keep')
+        self.mock('tar','echo partial > "$2"; exit 2')
+        result=self.run_script('backup/backup_script',src,dest)
+        self.assertNotEqual(result.returncode,0)
+        self.assertFalse(list(dest.glob('admin-backup-*.tar.gz')))
+        self.assertTrue(list(dest.glob('*.partial.*')))
+        self.assertEqual(old.read_text(),'keep')
+        self.assertNotIn('Backup verified',result.stderr)
+    def test_wrong_mount_and_recursive_destination_rejected(self):
+        src,dest=self.backup_fixture(); self.env['EXPECTED_BACKUP_SOURCE']='wrong-device'
+        self.assertNotEqual(self.run_script('backup/backup_script',src,dest).returncode,0)
+        self.assertEqual(list(dest.iterdir()),[])
+        inside=src/'backup'; inside.mkdir()
+        self.assertNotEqual(self.run_script('backup/backup_script',src,inside).returncode,0)
+    def test_existing_final_archive_is_never_overwritten(self):
+        src,dest=self.backup_fixture(); target=dest/'existing.tar.gz'; target.write_text('not an archive')
+        env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+        result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True)
+        self.assertNotEqual(result.returncode,0); self.assertEqual(target.read_text(),'not an archive')
+    def test_service_states_fail_closed_without_restart(self):
+        for load,active,code,expected in [('loaded','active',0,0),('loaded','failed',0,1),('loaded','inactive',0,1),('masked','inactive',0,1),('not-found','inactive',0,1),('','',1,1)]:
+            self.mock('systemctl',f'[[ $1 == show ]] || exit 99\nprintf "LoadState={load}\\nActiveState={active}\\n"\nexit {code}')
+            result=self.run_script('monitoring/service_uptime','nginx')
+            self.assertEqual(result.returncode,expected,result.stderr)
+        self.assertNotEqual(self.run_script('monitoring/service_uptime').returncode,0)
+    def test_checksum_collision_never_overwrites_evidence(self):
+        src,dest=self.backup_fixture()
+        for kind in ['file','symlink','directory']:
+            target=dest/(kind+'.tar.gz'); sidecar=Path(str(target)+'.sha256')
+            evidence=dest/(kind+'-evidence'); evidence.write_text('retain')
+            if kind=='file': sidecar.write_text('retain')
+            elif kind=='symlink': sidecar.symlink_to(evidence)
+            else: sidecar.mkdir()
+            env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+            result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True)
+            self.assertNotEqual(result.returncode,0)
+            self.assertFalse(target.exists())
+            self.assertEqual(evidence.read_text(),'retain')
+            if kind!='directory': self.assertEqual(sidecar.read_text(),'retain')
+    def test_checksum_failure_is_not_a_verified_backup(self):
+        src,dest=self.backup_fixture(); target=dest/'failed.tar.gz'
+        self.mock('sha256sum','exit 1')
+        env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+        result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True,text=True)
+        self.assertNotEqual(result.returncode,0)
+        self.assertFalse(Path(str(target)+'.sha256').exists())
+        self.assertNotIn('Verified archive:',result.stdout)
+        self.assertTrue(list(dest.glob('*.partial.*')))
+    def test_disk_preserves_mount_spaces_and_query_failure(self):
+        self.mock('df',"printf 'Type 1M-blocks Used Avail Use%% Mounted on\\next4 100M 80M 20M 80%% /data with spaces\\n'")
+        result=self.run_script('monitoring/disk_alert'); self.assertEqual(result.returncode,1)
+        self.assertIn('/data with spaces',result.stderr)
+        self.mock('df','exit 1')
+        result=self.run_script('monitoring/disk_alert'); self.assertNotEqual(result.returncode,0)
+        self.assertIn('UNKNOWN',result.stderr)
+    def test_nginx_invalid_inputs_never_reach_system_commands(self):
+        template=self.base/'template'; template.write_text('server_name {{DOMAIN}};')
+        for domain in ['', '../etc', '-bad.com', 'a..com', 'x.com/../../', 'bad name.com', 'a.com;id', 'a.com.']:
+            result=self.run_script('Nginx_create.sh',domain,template,'root')
+            self.assertNotEqual(result.returncode,0,domain)
+    def test_nginx_preview_does_not_mutate(self):
+        template=self.base/'template'; template.write_text('server_name {{DOMAIN}};')
+        self.mock('id','exit 0')
+        for command in ['nginx','mkdir','chown','chmod','ln','systemctl','rm']:
+            self.mock(command,'echo "UNEXPECTED MUTATION" >&2; exit 99')
+        result=self.run_script('Nginx_create.sh','example.test',template,'root')
+        self.assertEqual(result.returncode,0,result.stderr)
+        self.assertIn('server_name example.test;',result.stdout)
+        self.assertNotIn('UNEXPECTED',result.stderr)
+    def test_scan_rejects_invalid_address_before_network(self):
+        self.mock('nc','echo NETWORK_CALLED; exit 99')
+        for ip in ['256.1.1.1','1.2.3','-1.2.3.4','1.2.3.4;id']:
+            result=self.run_script('audit/ScanPort.sh',ip,'--scan')
+            self.assertNotEqual(result.returncode,0); self.assertNotIn('NETWORK_CALLED',result.stdout)
+
+if __name__=='__main__': unittest.main()