add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/001-create-swap.sh

@@ -25,6 +25,14 @@ case "${1:-}" in
     fi
     echo "    swap 2GB enabled + fstab entry + vm.swappiness=10"
     ;;
+  status)
+    swapon --show --noheadings 2>/dev/null | grep -q '^/swapfile ' \
+      || { echo "DRIFT /swapfile not active"; exit 1; }
+    grep -q '^/swapfile ' /etc/fstab || { echo "DRIFT fstab entry missing"; exit 1; }
+    swp=$(cat /proc/sys/vm/swappiness 2>/dev/null || echo '?')
+    [[ $swp == 10 ]] || { echo "DRIFT vm.swappiness=$swp (want 10)"; exit 1; }
+    echo "OK swap active + fstab entry, swappiness=10"
+    ;;
   down)
     swapoff /swapfile
     rm -f /swapfile

migrations/002-disable-networkd-dispatcher.sh

@@ -6,6 +6,15 @@ set -euo pipefail
 case "${1:-}" in
   up)   systemctl disable --now networkd-dispatcher.service
         echo "    networkd-dispatcher stopped and disabled" ;;
+  status)
+        en=$(systemctl is-enabled networkd-dispatcher.service 2>/dev/null || true)
+        ac=$(systemctl is-active networkd-dispatcher.service 2>/dev/null || true)
+        if [[ $en == disabled && $ac != active ]]; then
+          echo "OK networkd-dispatcher disabled, $ac"
+        else
+          echo "DRIFT networkd-dispatcher enabled=$en active=$ac (want disabled/inactive)"
+          exit 1
+        fi ;;
   down) systemctl enable --now networkd-dispatcher.service
         echo "    networkd-dispatcher re-enabled" ;;
 esac

migrations/003-purge-exim4.sh

@@ -11,6 +11,12 @@ case "${1:-}" in
         apt-get purge -y exim4-daemon-light >/dev/null
         apt-get autoremove --purge -y >/dev/null
         echo "    exim4 stopped + package purged + deps cleaned" ;;
+  status)
+        if dpkg-query -W -f='${db:Status-Abbrev}' exim4-daemon-light 2>/dev/null | grep -q '^ii'; then
+          echo "DRIFT exim4-daemon-light is installed"
+          exit 1
+        fi
+        echo "OK exim4-daemon-light not installed" ;;
   down) apt-get update -qq
         apt-get install -y exim4-daemon-light >/dev/null
         systemctl enable --now exim4.service

migrations/004-purge-haveged.sh

@@ -10,6 +10,12 @@ case "${1:-}" in
         apt-get purge -y haveged >/dev/null
         apt-get autoremove --purge -y >/dev/null
         echo "    haveged stopped + package purged" ;;
+  status)
+        if dpkg-query -W -f='${db:Status-Abbrev}' haveged 2>/dev/null | grep -q '^ii'; then
+          echo "DRIFT haveged is installed"
+          exit 1
+        fi
+        echo "OK haveged not installed" ;;
   down) apt-get update -qq
         apt-get install -y haveged >/dev/null
         systemctl enable --now haveged.service

migrations/005-mount-pgdata.sh

@@ -30,6 +30,15 @@ case "${1:-}" in
     mount "$MOUNTPOINT"   # via fstab entry - also validates it
     echo "    $dev mounted at $MOUNTPOINT (noatime, fstab entry added)"
     ;;
+  status)
+    src=$(findmnt -rn -o SOURCE "$MOUNTPOINT" 2>/dev/null || true)
+    want=$(findfs UUID="$DISK_UUID" 2>/dev/null || true)
+    [[ -n $src ]] || { echo "DRIFT $MOUNTPOINT not mounted"; exit 1; }
+    [[ $src == "$want" ]] || { echo "DRIFT $MOUNTPOINT mounted from $src (want $want)"; exit 1; }
+    grep -q "^UUID=$DISK_UUID $MOUNTPOINT " /etc/fstab \
+      || { echo "DRIFT fstab entry missing"; exit 1; }
+    echo "OK $src at $MOUNTPOINT + fstab entry"
+    ;;
   down)
     # sysmig rolls back in reverse order, so 006 (postgres) is already down
     if findmnt -rn "$MOUNTPOINT" >/dev/null; then umount "$MOUNTPOINT"; fi

migrations/006-install-postgres.sh

@@ -50,6 +50,18 @@ EOF
     fi
     pg_lsclusters --no-header
     ;;
+  status)
+    command -v pg_lsclusters >/dev/null 2>&1 \
+      || { echo "DRIFT postgresql-common not installed"; exit 1; }
+    line=$(pg_lsclusters --no-header | awk -v v="$PGVER" '$1==v' | head -1)
+    [[ -n $line ]] || { echo "DRIFT no PG $PGVER cluster"; exit 1; }
+    read -r _ name _ st _ datadir _ <<<"$line"
+    [[ $st == online ]] || { echo "DRIFT cluster $PGVER/$name is '$st'"; exit 1; }
+    [[ $(findmnt -rn -o TARGET -T "$datadir") == "$PGROOT" ]] \
+      || { echo "DRIFT $datadir not on $PGROOT"; exit 1; }
+    [[ -f $SRC ]] || { echo "DRIFT PGDG repo file $SRC missing"; exit 1; }
+    echo "OK PG $PGVER/$name online, data on $PGROOT, PGDG repo present"
+    ;;
   down)
     { pg_lsclusters --no-header 2>/dev/null || true; } | while read -r ver name _; do
       pg_ctlcluster "$ver" "$name" stop 2>/dev/null || true

migrations/007-postgres-admin-role.sh

@@ -29,6 +29,20 @@ case "${1:-}" in
       "SELECT current_user || ' (superuser=' || rolsuper || ')' FROM pg_roles WHERE rolname = current_user")
     echo "    peer-auth check: $check"
     ;;
+  status)
+    if [[ $EUID -eq 0 ]]; then
+      q() { runuser -u postgres -- psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    elif psql -d postgres -tAc 'SELECT 1' >/dev/null 2>&1; then
+      q() { psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    else
+      echo "? needs root or peer DB access to verify"
+      exit 2
+    fi
+    row=$(q "SELECT rolsuper::text || '/' || rolcanlogin FROM pg_roles WHERE rolname='$ROLE'")
+    [[ -n $row ]] || { echo "DRIFT role $ROLE does not exist"; exit 1; }
+    [[ $row == true/true ]] || { echo "DRIFT role $ROLE super/login=$row (want true/true)"; exit 1; }
+    echo "OK role $ROLE exists: superuser + login"
+    ;;
   down)
     if role_exists; then
       if runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qc "DROP ROLE $ROLE"; then

migrations/008-create-db-iwanhae.sh

@@ -30,6 +30,20 @@ case "${1:-}" in
       echo "    database $DB created, owner $ROLE"
     fi
     ;;
+  status)
+    if [[ $EUID -eq 0 ]]; then
+      q() { runuser -u postgres -- psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    elif psql -d postgres -tAc 'SELECT 1' >/dev/null 2>&1; then
+      q() { psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    else
+      echo "? needs root or peer DB access to verify"
+      exit 2
+    fi
+    row=$(q "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname='$DB'")
+    [[ -n $row ]] || { echo "DRIFT database $DB does not exist"; exit 1; }
+    [[ $row == "$ROLE" ]] || { echo "DRIFT database $DB owner=$row (want $ROLE)"; exit 1; }
+    echo "OK database $DB exists, owner $ROLE"
+    ;;
   down)
     if ! db_exists; then
       echo "    database $DB does not exist - nothing to do"