# Every real filesystem must be under the threshold. The exclusions are all
    # pseudo-filesystems whose "usage" is not a disk-space fact an operator can
    # act on: tmpfs and devtmpfs are RAM, squashfs is read-only, overlay is a
    # container layer, and efivarfs is UEFI variable storage - which sits near
    # 90% full on a perfectly healthy machine and would page every single day.
    #
    # NOTE: no -P. `df -P --output=...` fails with "options -P and --output are
    # mutually exclusive", and an earlier version of this check had both - so df
    # errored, the loop read nothing, and it reported "max 0% on /" and exited 0
    # on every host regardless of real usage. A disk check that always says 0%
    # is worse than no disk check, so the guard below treats "no filesystems
    # read" as a failure rather than as health.
    local threshold={{ healthcheck_disk_threshold }}
    local worst=0 worst_mount="" over="" seen=0

    while read -r pct mount; do
        pct=${pct%\%}
        [ -z "$pct" ] && continue
        case "$pct" in (*[!0-9]*) continue;; esac
        seen=$((seen + 1))
        if [ "$pct" -gt "$worst" ]; then worst=$pct; worst_mount=$mount; fi
        if [ "$pct" -ge "$threshold" ]; then over="${over}${over:+, }${mount} ${pct}%"; fi
    done < <(df -x tmpfs -x devtmpfs -x squashfs -x overlay -x efivarfs -x ramfs --output=pcent,target 2>/dev/null | tail -n +2)

    if [ "$seen" -eq 0 ]; then
        MESSAGE="df returned no filesystems - the check itself is broken"
        return 1
    fi

    if [ -n "$over" ]; then
        MESSAGE="over ${threshold}%: ${over}"
        return 1
    fi
    MESSAGE="max ${worst}% on ${worst_mount:-/} (${seen} filesystems)"
    return 0