# Operator scripts — scope classes

Scripts here touch **live Proxmox / edge** systems. Prefer **narrow scope** and **dry-run first**.

| Script | Class | Notes |
|--------|-------|--------|
| `start-stopped-lxc-scoped.sh` | **Scoped mutate** | Requires `--host` + `--vmid` (repeat); default dry-run; `--apply` or `PROXMOX_OPS_APPLY=1` to run `pct start`. |
| `upgrade-gitea-lxc.sh` | Scoped | Use `--dry-run` per script header. |

**Shared helpers:** `scripts/lib/proxmox-production-guard.sh` — `PROXMOX_OPS_APPLY`, `PROXMOX_OPS_ALLOWED_VMIDS`, `PROXMOX_SAFE_DEFAULTS`.

**Broad orchestration** (multiple subsystems) remains in `scripts/run-all-operator-tasks-from-lan.sh` and `scripts/maintenance/run-all-maintenance-via-proxmox-ssh.sh` — review `--dry-run` before running on production.

See also: `AGENTS.md` (Production safety), `.cursor/rules/proxmox-production-safety.mdc`.