feat: Phase 3 threshold keys, arch-audit dep, btrfs scrub timer

The thresholds TOML gains packages.keyring_warn_days, the [security] cve_min_warn floor, [systemd] expected_timers_extra, and two curation tables: kept_orphans (deliberate keeps the orphan count skips) and qkk_known (fnmatch paths for -Qkk mismatches that are config knowledge, like the resolver symlink and the pacman-contrib file this script edits itself).

The installer now pulls arch-audit (the console's CVE source) and enables btrfs-scrub@-.timer on btrfs installs. Ratio had the scrub timer enabled out-of-band, so a fresh install would have warned "missing" forever on the console's maintenance-timers check. The todo Phase 3 task closes as a dated log entry.

3 files changed, 39 insertions, 2 deletions

diff --git a/archsetup b/archsetup
index 1fd5317..fa26487 100755
--- a/archsetup
+++ b/archsetup
@@ -1672,6 +1672,7 @@ configure_package_cache() {
 
     display "subtitle" "Package Repository Cache Maintenance"
     pacman_install pacman-contrib
+    pacman_install arch-audit                        # CVE report from Arch Security Team data (maintenance console)
     run_task "enabling the package cache cleanup timer" systemctl enable --now paccache.timer
 
     action="configuring paccache to keep 3 versions" && display "task" "$action"
@@ -1857,6 +1858,11 @@ configure_btrfs_snapshots() {
         run_task "enabling snapper timeline timer" systemctl enable snapper-timeline.timer
         systemctl enable snapper-cleanup.timer >> "$logfile" 2>&1 || error_warn "$action" "$?"
 
+        # Monthly data scrub — the maintenance console's scrub-age and
+        # expected-timers checks assume this runs (mirrors the ZFS branch's
+        # zfs-scrub-weekly@). The "-" instance is systemd escaping for "/".
+        run_task "enabling monthly btrfs scrub timer" systemctl enable btrfs-scrub@-.timer
+
         run_task "enabling grub-btrfsd for boot menu snapshots" systemctl enable grub-btrfsd
 
         # Allow user to use snapper without root (required for snapper-gui)
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml
index f729a01..898f47a 100644
--- a/configs/maintenance-thresholds.toml
+++ b/configs/maintenance-thresholds.toml
@@ -43,12 +43,23 @@ zfs_space_warn_pct = 20             # snapshot space vs pool capacity
 
 [packages]
 cache_warn_gb = 10                  # suggest paccache beyond the weekly keep-3
+keyring_warn_days = 60              # stale archlinux-keyring silently breaks updates
+
+[security]
+cve_min_warn = "high"               # arch-audit severity floor that warns (the
+                                    # constant Unknown/Low tail is background)
 
 [updates]
 pending_warn = 50                   # "a lot" — reddens the strip border
 cache_stale_hours = 6               # network-tier cache older than this warns
 topgrade_warn_days = 14             # topgrade freshness
 
+[systemd]
+# The capability-derived expected set (paccache/reflector always;
+# btrfs-scrub@ + snapper timers on btrfs; sanoid + zfs-scrub-weekly@ on ZFS)
+# lives in code — this list adds host-agnostic extras on top.
+expected_timers_extra = []
+
 [logs]
 app_log_warn_days = 7               # log-cleanup cron should hold ~7 days
 journal_digest_top = 10             # groups shown in the journal digest
@@ -91,3 +102,23 @@ entries = ["winvm"]
 [curation.pacnew_safe_delete]
 # Regenerated files whose .pacnew is safe to drop (reflector-managed / local).
 entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"]
+
+[curation.kept_orphans]
+# Packages pacman calls orphaned that are deliberate keeps (the rust lesson):
+# listed in evidence but never counted or warned on. KEEP/UNMARK levers write
+# the user layer; this shipped list stays empty.
+entries = []
+
+[curation.qkk_known]
+# pacman -Qkk mismatches that are config knowledge, not integrity findings
+# (fnmatch patterns). Unverifiable reads and mtime-only mismatches are
+# already excluded in code; this covers managed symlinks, regenerated
+# caches, and files archsetup itself edits.
+entries = [
+  "/etc/resolv.conf",                              # resolver-managed symlink
+  "/usr/lib/jvm/default",                          # archlinux-java symlinks
+  "/usr/lib/jvm/default-runtime",
+  "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg
+  "/usr/lib/vlc/plugins/plugins.dat",              # regenerated plugin cache
+  "/etc/conf.d/pacman-contrib",                    # archsetup sets PACCACHE_ARGS
+]
diff --git a/todo.org b/todo.org
index f2ac3c8..52da13e 100644
--- a/todo.org
+++ b/todo.org
@@ -33,8 +33,8 @@ maint/ package + shim + tests/maint/ (48 tests, fake-tool harness); thresholds t
 *** 2026-07-07 Tue @ 20:49:05 -0500 Built Phase 2 — storage & snapshot collectors (dotfiles 94e8371)
 All Phase 2 collectors TDD'd against the fake-tool harness (argv-matched cases added): btrfs unallocated/scrub-age/device-errors (SMART cross-check), per-disk SMART health + last self-test, fstrim posture (discard mount option = continuous trim, ratio's real setup), disk top-consumers on a new slow-local cache (=maint scan --slow=, ~/.local/state/maint), snapper counts split timeline·single·pre-post (split keys on cleanup, not type), full ZFS family. =priv.py= pulled forward from Phase 6 (read-only verbs =smart_json= + =btrfs_scrub_status=, validated args, MAINT_SUDO) so probes stay elevation-free. maint suites 48→118; make test green (51). Live read-only verified on BOTH hosts: ratio worst=warn (10.75 GB cache; scrub 0d, SMART ok), velox over tailscale shows the ZFS family live (ONLINE/autotrim-on/scrub 1d/231 snaps) with a genuine fstrim warn (timer off — Phase 6 Confirm remedy). TOML gained storage keys (btrfs_unalloc_warn_gb, smart_*, fstrim_stale_days, hog_*); installed copies refreshed on ratio + velox.
 
-*** TODO Phase 3 — collectors: packages, security, systemd :solo:
-Cache size, orphans (name+size), pacnew classification, keyring freshness, reboot-required, -Qkk (slow-local, parses output not exit code); network-tier cache readers (checkupdates, arch-audit CVEs, AUR, fwupd, topgrade freshness) with age; is-system-running + cause, failed-unit roster, maintenance-timers meta-metric, taint decode. Prereq: add arch-audit to archsetup deps + install. Verify: unit green + live read-only on ratio.
+*** 2026-07-07 Tue @ 21:30:59 -0500 Built Phase 3 — packages, security, systemd collectors (dotfiles 3eaab6e)
+All Phase 3 collectors TDD'd: orphans name+size with [curation.kept_orphans], pacnew safe-delete vs needs-merge, keyring freshness, reboot-required (uname -r vs modules dir), -Qkk on =maint scan --slow= with a noise split (unverifiable-as-user reads, mtime-only, [curation.qkk_known] paths tallied but never counted — an unfiltered live run sat permanently red at 68 "altered" files; classified, ratio shows 10 real findings); =maint scan --net= writes checkupdates/yay/arch-audit/fwupd caches (yay rc-1-silent = AUR-clean zero; failures never clobber good cache; malformed payloads degrade to unprobed), readers grade with age + stale bump; is-system-running with state-aware cause, failed-unit roster since/exit/journalctl hint, maintenance-timers meta-metric (capability-derived expected set, @-prefix instance match), taint letters decoded. Prereq done: arch-audit added to archsetup deps + installed both hosts. Review subagent (live-verified) found 2 Important (yay AUR-clean rc quirk, cache-shape envelope kill) + 2 minor — all fixed red-first; archsetup now enables btrfs-scrub@-.timer on btrfs installs (was ratio-only out-of-band, the meta-metric expects it). maint suites 118→169; full make test green. Live on ratio: 23-metric envelope, worst=warn from real findings (10.75GB cache, 8 orphans, mirrorlist.pacnew, 713 repo updates, 32 CVEs, 1 firmware).
 
 *** TODO Phase 4 — collectors: logs, memory, power :solo:
 Journal digest (identifier groups, noise layers), coredumps by binary, kernel/hw events; memory + top-5, OOM, swap/zram, temps, throttle, EPP read, battery health + charge threshold read, unclean-shutdown rate. Verify: unit green + live read-only on ratio.