# Every real filesystem must be under the threshold. tmpfs, devtmpfs,
    # squashfs and overlay are excluded: they are either RAM, read-only, or
    # container layers, and none of them fills up in a way an operator can act on.
    local threshold={{ healthcheck_disk_threshold }}
    local worst=0 worst_mount="" over=""

    while read -r pct mount; do
        pct=${pct%\%}
        [ -z "$pct" ] && continue
        if [ "$pct" -gt "$worst" ]; then worst=$pct; worst_mount=$mount; fi
        if [ "$pct" -ge "$threshold" ]; then over="${over}${over:+, }${mount} ${pct}%"; fi
    done < <(df -P -x tmpfs -x devtmpfs -x squashfs -x overlay --output=pcent,target 2>/dev/null | tail -n +2)

    if [ -n "$over" ]; then
        MESSAGE="over ${threshold}%: ${over}"
        return 1
    fi
    MESSAGE="max ${worst}% on ${worst_mount:-/}"
    return 0