Complete procedures with a way back.

Distinguish block, inode, reservation, mount, journal, container, and deleted-open-file pressure; recover a small safe operating margin; identify the owning process or retention policy; and verify that space remains available after normal workload resumes.

Make local journals persistent and bounded, receive per-host journal files on a dedicated collector, and upload structured events over mutually authenticated TLS while preserving a local buffer and auditable failure behavior.

Use a dedicated identity, explicit paths, bounded restarts, sandboxing, logs, and a verified rollback.