diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 1ab419c..2c54e23 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -25,20 +25,20 @@ When generating code for this repository:
 ## Project Structure
 
 ```
-hmib/                       # Repository root (install to plugins/hmib/ in Cacti)
-├── images/                  # UI icons
-├── locales/                  # Internationalization files
-├── templates/                 # Device/graph template XML
-├── associate_os_type.php        # Maps discovered devices to Host MIB types
-├── hmib.php                      # Main viewer (summary, hardware, storage, software, running, devices)
-├── hmib_types.php                  # Host MIB type administration
-├── poller_graphs.php                # Graph URL helper output
-├── poller_hmib.php                   # Background poller entry point (CLI)
-├── snmp.php                           # SNMP collection routines
-├── snmp_functions.php                  # SNMP helper/formatting functions
-├── INFO                                 # Plugin metadata (name, version, compat)
+hmib/                     # Repository root (install to plugins/hmib/ in Cacti)
+├── images/               # UI icons
+├── locales/              # Internationalization files
+├── templates/            # Device/graph template XML
+├── associate_os_type.php # Maps discovered devices to Host MIB types
+├── hmib.php              # Main viewer (summary, hardware, storage, software, running, devices)
+├── hmib_types.php        # Host MIB type administration
+├── poller_graphs.php     # Graph URL helper output
+├── poller_hmib.php       # Background poller entry point (CLI)
+├── snmp.php              # SNMP collection routines
+├── snmp_functions.php    # SNMP helper/formatting functions
+├── INFO                  # Plugin metadata (name, version, compat)
 ├── README.md
-└── setup.php                             # Plugin install/uninstall/upgrade hooks
+└── setup.php             # Plugin install/uninstall/upgrade hooks
 ```
 
 ## Naming Conventions
@@ -210,3 +210,7 @@ existing code or adding new code, not just in dedicated cleanup passes:
   line, `@param` lines, a blank comment line, then `@return`. Infer parameter/return types from
   actual usage; don't change the function's real type-hints in the same pass (let static analysis
   flag mismatches separately). Skip vendored third-party library files.
+
+## File manifest & upgrade pruning
+
+The plugin ships a root `manifest.json` with three arrays: `tombstones` (files/directories older versions shipped that have since moved or been removed), `expected` (the top-level files and directories that ship today, directories written with a trailing `/`), and `whitelist` (paths holding user data that must never be touched). Keep `expected` current: CI runs `tests/bin/validate-manifest.php`, which fails on any drift between `expected` and the real top-level tree (it ignores `tests/`, `phpunit.xml`, `.git*`, `.md*`, and whitelisted paths). Custom customer CSS/theme files belong in `expected`, and stylesheets live in `css/` (not `themes/`). On upgrade, `hmib_prune_files()` deletes the tombstoned paths, the dev-only `tests/` tree, and the `phpunit.xml` test config, leaves `whitelist`, `.git*`, and `.md*` alone, and logs (without removing) any top-level entry the manifest does not account for. As a safety measure it refuses any tombstone that resolves outside the plugin directory (a tampered manifest.json) and logs a warning for any file or directory it cannot remove. When you move or delete a shipped file, add its old path to `tombstones` and update `expected` in the same change.
diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 1d988a3..93581b1 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -89,6 +89,9 @@ jobs:
     - name: Check PHP version
       run: php -v
 
+    - name: Validate plugin manifest (expected-file drift)
+      run: php cacti/plugins/hmib/tests/bin/validate-manifest.php
+
     - name: Run apt-get update
       run: sudo apt-get update
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 53a144f..d6da243 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ChangeLog
 
 --- develop ---
+* dev: Relocate schema provisioning into includes/database.php (loaded from setup.php) and add the fleet manifest.json with upgrade-time file pruning
 * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step, and measure coverage with xdebug so the plugin's own sources are instrumented
 * issue: Fix PHP 8.1+ 'float-string to int loses precision' deprecation from runCollector() by typing the last-run timestamp parameter as float
 * dev: Bring all plugin code to PHPStan level 8 with accurate parameter and return types
diff --git a/includes/database.php b/includes/database.php
new file mode 100644
index 0000000..0dbe9a5
--- /dev/null
+++ b/includes/database.php
@@ -0,0 +1,288 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Creates (if not already present) all of this plugin's database
+ * tables: plugin_hmib_hrDevices and the other Host Resources data
+ * tables, type/system tables, and the process-lock table. Called from
+ * plugin_hmib_install().
+ *
+ * @return void
+ *
+ * @global array $config           Cacti global configuration array;
+ *                                 used to include the database library.
+ * @global mixed $database_default Reserved/declared for parity with
+ *                                 other setup functions; not used
+ *                                 directly here.
+ */
+function hmib_setup_table(): void {
+	global $config, $database_default;
+	include_once($config['library_path'] . '/database.php');
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrDevices` (
+		`host_id` int(10) unsigned NOT NULL,
+		`index` int(10) unsigned NOT NULL,
+		`type` int(10) unsigned NOT NULL DEFAULT '1',
+		`description` varchar(255) NOT NULL DEFAULT '',
+		`status` int(10) unsigned NOT NULL DEFAULT '0',
+		`errors` int(10) unsigned NOT NULL DEFAULT '0',
+		`present` tinyint(3) unsigned NOT NULL DEFAULT '1',
+		PRIMARY KEY (`host_id`,`index`),
+		INDEX `description` (`description`),
+		INDEX `index` (`index`))
+		ENGINE=MyISAM
+		COMMENT='Stores Device Information';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWInstalled` (
+		`host_id` int(10) unsigned NOT NULL,
+		`index` int(10) unsigned NOT NULL,
+		`name` varchar(255) NOT NULL default '',
+		`type` int(10) unsigned NOT NULL default '1',
+		`date` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+		`present` tinyint(3) unsigned NOT NULL default '1',
+		PRIMARY KEY  (`host_id`,`index`),
+		INDEX `name` (`name`),
+		INDEX `index` (`index`))
+		ENGINE=MyISAM
+		COMMENT='Catalogue of Installed Software';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrProcessor` (
+		`host_id` int(10) unsigned NOT NULL,
+		`index` int(10) unsigned NOT NULL,
+		`load` int(10) unsigned NOT NULL default '0',
+		`present` tinyint(3) unsigned NOT NULL default '1',
+		PRIMARY KEY  (`host_id`,`index`),
+		INDEX `index` (`index`))
+		ENGINE=MyISAM
+		COMMENT='Stores Processor Information';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrStorage` (
+		`host_id` int(10) unsigned NOT NULL,
+		`index` int(10) unsigned NOT NULL,
+		`type` int(10) unsigned NOT NULL default '1',
+		`description` varchar(255) NOT NULL default '',
+		`allocationUnits` int(10) unsigned NOT NULL default '0',
+		`size` int(10) unsigned NOT NULL default '0',
+		`used` int(10) unsigned NOT NULL default '0',
+		`failures` int(10) unsigned NOT NULL default '0',
+		`present` tinyint(3) unsigned NOT NULL default '1',
+		PRIMARY KEY  (`host_id`,`index`),
+		INDEX `description` (`description`),
+		INDEX `index` (`index`))
+		ENGINE=MyISAM
+		COMMENT='Stores the Storage Information';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWRun` (
+		`host_id` int(10) unsigned NOT NULL,
+		`index` int(10) unsigned NOT NULL,
+		`name` varchar(64) NOT NULL default '',
+		`path` varchar(255) NOT NULL default '',
+		`parameters` varchar(255) NOT NULL default '',
+		`type` int(10) unsigned NOT NULL default '1',
+		`status` int(10) unsigned NOT NULL default '0',
+		`perfCPU` int(10) unsigned NOT NULL default '0',
+		`perfMemory` int(10) unsigned NOT NULL default '0',
+		`present` tinyint(3) unsigned NOT NULL default '1',
+		PRIMARY KEY  (`index`,`host_id`),
+		INDEX `name` (`name`),
+		INDEX `index` (`index`))
+		ENGINE=MyISAM
+		COMMENT='Displays Running Process Information';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWRun_last_seen` (
+		`host_id` int(10) unsigned NOT NULL,
+		`name` varchar(64) NOT NULL,
+		`total_time` bigint(20) unsigned NOT NULL default '0',
+		`last_seen` timestamp NOT NULL default CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+		PRIMARY KEY  (`host_id`, `name`),
+		INDEX `name` (`name`))
+		ENGINE=MyISAM
+		COMMENT='Displays when a binary was last seen running on the host';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSystem` (
+		`host_id` int(10) unsigned NOT NULL,
+		`host_type` int(10) unsigned NOT NULL default '0',
+		`host_status` int(10) unsigned NOT NULL default '0',
+		`uptime` int(10) unsigned NOT NULL default '0',
+		`date` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+		`initLoadDevice` int(10) unsigned NOT NULL default '0',
+		`initLoadParams` varchar(255) NOT NULL default '',
+		`users` int(10) unsigned NOT NULL default '0',
+		`cpuPercent` int(10) unsigned NOT NULL default '0',
+		`numCpus` int(10) unsigned NOT NULL default '0',
+		`processes` int(10) unsigned NOT NULL default '0',
+		`maxProcesses` int(10) unsigned NOT NULL default '0',
+		`memSize` BIGINT unsigned NOT NULL default '0',
+		`memUsed` FLOAT NOT NULL default '0',
+		`swapSize` BIGINT UNSIGNED NOT NULL default '0',
+		`swapUsed` FLOAT NOT NULL default '0',
+		`sysDescr` varchar(255) NOT NULL default '',
+		`sysObjectID` varchar(128) NOT NULL default '',
+		`sysUptime` int(10) unsigned NOT NULL default '0',
+		`sysName` varchar(64) NOT NULL default '',
+		`sysContact` varchar(128) NOT NULL default '',
+		`sysLocation` varchar(255) NOT NULL default '',
+		PRIMARY KEY  (`host_id`),
+		INDEX `host_type` (`host_type`),
+		INDEX `host_status` (`host_status`))
+		ENGINE=MyISAM
+		COMMENT='Contains all Hosts that support hostMib';");
+
+	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_processes` (
+		`pid` int(10) unsigned NOT NULL,
+		`taskid` int(10) unsigned NOT NULL,
+		`started` timestamp NOT NULL default CURRENT_TIMESTAMP,
+		PRIMARY KEY  (`pid`))
+		ENGINE=MEMORY
+		COMMENT='Running collector processes';");
+
+	db_execute("CREATE TABLE `plugin_hmib_types` (
+		`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
+		`oid` varchar(40) NOT NULL,
+		`description` varchar(30) NOT NULL,
+		PRIMARY KEY (`oid`),
+		INDEX `id`(`id`))
+		ENGINE=MyISAM
+		COMMENT='OID Types for the Host MIB Resources';");
+
+	db_execute("CREATE TABLE `plugin_hmib_hrSystemTypes` (
+		`id` INT(10) unsigned NOT NULL AUTO_INCREMENT,
+		`sysObjectID` VARCHAR(100) NOT NULL,
+		`sysDescrMatch` VARCHAR(100) NOT NULL,
+		`name` VARCHAR(40) NOT NULL,
+		`version` VARCHAR(10) NOT NULL,
+		PRIMARY KEY (`sysObjectID`, `sysDescrMatch`),
+		INDEX `name`(`name`),
+		INDEX `id`(`id`))
+		ENGINE = MyISAM
+		COMMENT='Maps OS Names and Versions to Object ID';");
+
+	db_execute("CREATE TABLE `plugin_hmib_hrSWRun_ignore` (
+		`name` varchar(64) NOT NULL,
+		`enabled` char(2) NOT NULL default '',
+		`notes` varchar(255) NOT NULL default '',
+		PRIMARY KEY  (`name`))
+		ENGINE=MyISAM
+		COMMENT='The process names that we are interested in tracking at the host level';");
+
+	db_execute("INSERT INTO `plugin_hmib_hrSystemTypes` VALUES
+		(1,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Version 6.1','Windows 7','7'),
+		(2,'.1.3.6.1.4.1.311.1.1.3.1.2',  'Version 6.1','Windows 2008 Server','2008'),
+		(3,'.1.3.6.1.4.1.311.1.1.3.1.3',  'Version 6.1','Windows 2008 Domain Contr','2008'),
+		(4,'.1.3',                        'Linux NAS%armv5tejl','DNS-321',''),
+		(5,'.1.3.6.1.4.1.2.3.1.2.1.1.3',  'IBM%AIX%05.03','AIX','5.3'),
+		(6,'.1.3.6.1.4.1.8072.3.2.10',    'Linux%2.6.16.21-0.8%','SUSE','10.2'),
+		(7,'.1.3.6.1.4.1.311.1.1.3.1.1',  'EM64T%Windows Version 5.2','Windows XP x64','5.2'),
+		(8,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Windows 2000 Version 5.0','Windows 2000','5.0'),
+		(9,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Windows 2000 Version 5.1','Windows XP','5.1'),
+		(10,'.1.3.6.1.4.1.8072.3.2.10',   'Linux%2.6.16.60','SUSE','9.0'),
+		(11,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows 2000 Version 5.0','Windows 2000 Server','2000'),
+		(12,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows 2000 Version 5.1','Windows 2000 Server','2000'),
+		(13,'.1.3.6.1.4.1.311.1.1.3.1.3', 'Windows Version 5.2','Windows 2003 DC','2003'),
+		(14,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 5.2','Windows 2003 Server','2003'),
+		(16,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 6.2','Windows 2012 Server','2012'),
+		(17,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 6.3','Windows 2016 Server','2016'),
+		(18,'.1.3.6.1.4.1.8072.3.2.10', 'Linux','Linux','Linux'),
+		(19,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%gentoo%','Gentoo Linux','Gentoo'),
+		(20,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%ubuntu%','Ubuntu','ubuntu'),
+		(21,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%centos%','CentOS','CentOS'),
+		(22,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%ndlp%','McAfee Network DLP','DLP'),
+		(23,'.1.3', 'Linux%PAE%','Cisco UCM or CCX','UCM'),
+		(24,'.1.3', 'Identity Services Engine','Cisco ISE','ISE'),
+		(25,'.1.3', 'Cisco Prime Infrastructure','Cisco Prime Infrastructure','Prime'),
+		(26,'.1.3', 'AsyncOS','Cisco Web Security Appliance','WSA'),
+		(27,'.1.3', 'UCOS','Cisco Unity','CUC'),
+		(28,'.1.3.6.1.4.1.2.3.1.2.1.1.3', 'IBM%AIX%06.01%','AIX','6.1'),
+		(29,'', 'VMware ESXi','VMware ESXi','ESXi');");
+
+	db_execute("INSERT INTO `plugin_hmib_types` VALUES
+		(1,'.1.3.6.1.2.1.25.3.1.12','Co-Processor'),
+		(2,'.1.3.6.1.2.1.25.3.1.11','Audio'),
+		(3,'.1.3.6.1.2.1.25.3.1.10','Video'),
+		(4,'.1.3.6.1.2.1.25.3.1.2','Unknown'),
+		(5,'.1.3.6.1.2.1.25.3.1.1','Other'),
+		(6,'.1.3.6.1.2.1.25.3.1.13','Keyboard'),
+		(7,'.1.3.6.1.2.1.25.3.1.3','Processor'),
+		(8,'.1.3.6.1.2.1.25.3.1.4','Network'),
+		(9,'.1.3.6.1.2.1.25.3.1.5','Printer'),
+		(10,'.1.3.6.1.2.1.25.3.1.6','Disk'),
+		(11,'.1.3.6.1.2.1.25.2.1.1','Other Storage'),
+		(12,'.1.3.6.1.2.1.25.2.1.2','Ram Memory'),
+		(13,'.1.3.6.1.2.1.25.2.1.3','Virtual Memory'),
+		(14,'.1.3.6.1.2.1.25.2.1.4','Fixed Disk'),
+		(15,'.1.3.6.1.2.1.25.2.1.5','Removable Disk'),
+		(16,'.1.3.6.1.2.1.25.2.1.6','Floppy Disk'),
+		(17,'.1.3.6.1.2.1.25.2.1.7','Compact Disk'),
+		(18,'.1.3.6.1.2.1.25.2.1.8','Ram Disk'),
+		(19,'.1.3.6.1.2.1.25.2.1.9','Flash Memory'),
+		(20,'.1.3.6.1.2.1.25.2.1.10','Network Disk'),
+		(21,'.1.3.6.1.2.1.25.3.1.14','Modem'),
+		(22,'.1.3.6.1.2.1.25.3.1.18','Tape'),
+		(23,'.1.3.6.1.2.1.25.3.1.15','Parllel Port'),
+		(24,'.1.3.6.1.2.1.25.3.1.16','Pointing'),
+		(25,'.1.3.6.1.2.1.25.3.1.17','Serial Port'),
+		(26,'.1.3.6.1.2.1.25.3.1.19','Clock'),
+		(27,'.1.3.6.1.2.1.25.3.1.20','Volatile Memory'),
+		(28,'.1.3.6.1.2.1.25.3.1.21','Non Volatile Memory'),
+		(29,'.1.3.6.1.2.1.25.3.9.1','Other'),
+		(30,'.1.3.6.1.2.1.25.3.9.2','Unknown'),
+		(31,'.1.3.6.1.2.1.25.3.9.3','BerkleyFS'),
+		(32,'.1.3.6.1.2.1.25.3.9.4','Sys5FS'),
+		(33,'.1.3.6.1.2.1.25.3.9.6','HPFS'),
+		(34,'.1.3.6.1.2.1.25.3.9.7','HFS'),
+		(35,'.1.3.6.1.2.1.25.3.9.8','MFS'),
+		(36,'.1.3.6.1.2.1.25.3.9.10','VNode'),
+		(37,'.1.3.6.1.2.1.25.3.9.11','Journaled'),
+		(38,'.1.3.6.1.2.1.25.3.9.12','iso9660'),
+		(39,'.1.3.6.1.2.1.25.3.9.13','RockRidge'),
+		(40,'.1.3.6.1.2.1.25.3.9.14','NFS'),
+		(41,'.1.3.6.1.2.1.25.3.9.15','Netware'),
+		(42,'.1.3.6.1.2.1.25.3.9.16','AFS'),
+		(43,'.1.3.6.1.2.1.25.3.9.17','DFS'),
+		(44,'.1.3.6.1.2.1.25.3.9.18','AppleShare'),
+		(45,'.1.3.6.1.2.1.25.3.9.19','RFS'),
+		(46,'.1.3.6.1.2.1.25.3.9.20','DGCFS'),
+		(47,'.1.3.6.1.2.1.25.3.9.21','BFS'),
+		(48,'.1.3.6.1.2.1.25.3.9.22','FAT32'),
+		(49,'.1.3.6.1.2.1.25.3.9.23','Ext2'),
+		(50,'.1.3.6.1.2.1.25.3.9.5','FAT'),
+		(51,'.1.3.6.1.2.1.25.3.9.9','NTFS')");
+
+	// optimizations
+	if (!db_index_exists('data_input_data', 'data_template_data_id')) {
+		db_execute('ALTER TABLE data_input_data ADD INDEX data_template_data_id(data_template_data_id)');
+	}
+
+	if (!db_index_exists('data_input_data', 'data_input_field_id')) {
+		db_execute('ALTER TABLE data_input_data ADD INDEX data_input_field_id(data_input_field_id)');
+	}
+
+	if (!db_index_exists('snmp_query_graph', 'graph_template_id')) {
+		db_execute('ALTER TABLE snmp_query_graph ADD INDEX graph_template_id(graph_template_id)');
+	}
+
+	if (!db_index_exists('snmp_query_graph', 'snmp_query_id')) {
+		db_execute('ALTER TABLE snmp_query_graph ADD INDEX snmp_query_id(snmp_query_id)');
+	}
+}
diff --git a/manifest.json b/manifest.json
new file mode 100644
index 0000000..67340c9
--- /dev/null
+++ b/manifest.json
@@ -0,0 +1,22 @@
+{
+    "tombstones": [],
+    "expected": [
+        "CHANGELOG.md",
+        "INFO",
+        "LICENSE",
+        "README.md",
+        "associate_os_type.php",
+        "hmib.php",
+        "hmib_types.php",
+        "images/",
+        "includes/",
+        "index.php",
+        "locales/",
+        "manifest.json",
+        "poller_graphs.php",
+        "poller_hmib.php",
+        "setup.php",
+        "templates/"
+    ],
+    "whitelist": []
+}
diff --git a/phpunit.xml b/phpunit.xml
index 5c27d0c..ed881d9 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -28,6 +28,7 @@
     <source>
         <include>
             <file>setup.php</file>
+            <file>includes/database.php</file>
             <file>hmib.php</file>
             <file>hmib_types.php</file>
             <file>poller_hmib.php</file>
diff --git a/setup.php b/setup.php
index 4fe298a..604e2df 100644
--- a/setup.php
+++ b/setup.php
@@ -22,6 +22,8 @@
  +-------------------------------------------------------------------------+
 */
 
+require_once(__DIR__ . '/includes/database.php');
+
 /**
  * Return the CSP nonce attribute for inline <script> tags, safely across
  * Cacti versions. Newer Cacti releases enforce a Content-Security-Policy that
@@ -178,6 +180,9 @@ function hmib_check_upgrade(): void {
 			api_plugin_enable_hooks('hmib');
 		}
 
+		// Remove files tombstoned in manifest.json plus the dev-only tests/ tree.
+		hmib_prune_files();
+
 		db_execute("UPDATE plugin_config SET version='$current' WHERE directory='hmib'");
 		db_execute("UPDATE plugin_config SET
 			version='" . $info['version'] . "',
@@ -207,270 +212,6 @@ function hmib_check_dependencies(): bool {
 	return true;
 }
 
-/**
- * Creates (if not already present) all of this plugin's database
- * tables: plugin_hmib_hrDevices and the other Host Resources data
- * tables, type/system tables, and the process-lock table. Called from
- * plugin_hmib_install().
- *
- * @return void
- *
- * @global array $config           Cacti global configuration array;
- *                                 used to include the database library.
- * @global mixed $database_default Reserved/declared for parity with
- *                                 other setup functions; not used
- *                                 directly here.
- */
-function hmib_setup_table(): void {
-	global $config, $database_default;
-	include_once($config['library_path'] . '/database.php');
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrDevices` (
-		`host_id` int(10) unsigned NOT NULL,
-		`index` int(10) unsigned NOT NULL,
-		`type` int(10) unsigned NOT NULL DEFAULT '1',
-		`description` varchar(255) NOT NULL DEFAULT '',
-		`status` int(10) unsigned NOT NULL DEFAULT '0',
-		`errors` int(10) unsigned NOT NULL DEFAULT '0',
-		`present` tinyint(3) unsigned NOT NULL DEFAULT '1',
-		PRIMARY KEY (`host_id`,`index`),
-		INDEX `description` (`description`),
-		INDEX `index` (`index`))
-		ENGINE=MyISAM
-		COMMENT='Stores Device Information';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWInstalled` (
-		`host_id` int(10) unsigned NOT NULL,
-		`index` int(10) unsigned NOT NULL,
-		`name` varchar(255) NOT NULL default '',
-		`type` int(10) unsigned NOT NULL default '1',
-		`date` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
-		`present` tinyint(3) unsigned NOT NULL default '1',
-		PRIMARY KEY  (`host_id`,`index`),
-		INDEX `name` (`name`),
-		INDEX `index` (`index`))
-		ENGINE=MyISAM
-		COMMENT='Catalogue of Installed Software';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrProcessor` (
-		`host_id` int(10) unsigned NOT NULL,
-		`index` int(10) unsigned NOT NULL,
-		`load` int(10) unsigned NOT NULL default '0',
-		`present` tinyint(3) unsigned NOT NULL default '1',
-		PRIMARY KEY  (`host_id`,`index`),
-		INDEX `index` (`index`))
-		ENGINE=MyISAM
-		COMMENT='Stores Processor Information';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrStorage` (
-		`host_id` int(10) unsigned NOT NULL,
-		`index` int(10) unsigned NOT NULL,
-		`type` int(10) unsigned NOT NULL default '1',
-		`description` varchar(255) NOT NULL default '',
-		`allocationUnits` int(10) unsigned NOT NULL default '0',
-		`size` int(10) unsigned NOT NULL default '0',
-		`used` int(10) unsigned NOT NULL default '0',
-		`failures` int(10) unsigned NOT NULL default '0',
-		`present` tinyint(3) unsigned NOT NULL default '1',
-		PRIMARY KEY  (`host_id`,`index`),
-		INDEX `description` (`description`),
-		INDEX `index` (`index`))
-		ENGINE=MyISAM
-		COMMENT='Stores the Storage Information';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWRun` (
-		`host_id` int(10) unsigned NOT NULL,
-		`index` int(10) unsigned NOT NULL,
-		`name` varchar(64) NOT NULL default '',
-		`path` varchar(255) NOT NULL default '',
-		`parameters` varchar(255) NOT NULL default '',
-		`type` int(10) unsigned NOT NULL default '1',
-		`status` int(10) unsigned NOT NULL default '0',
-		`perfCPU` int(10) unsigned NOT NULL default '0',
-		`perfMemory` int(10) unsigned NOT NULL default '0',
-		`present` tinyint(3) unsigned NOT NULL default '1',
-		PRIMARY KEY  (`index`,`host_id`),
-		INDEX `name` (`name`),
-		INDEX `index` (`index`))
-		ENGINE=MyISAM
-		COMMENT='Displays Running Process Information';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSWRun_last_seen` (
-		`host_id` int(10) unsigned NOT NULL,
-		`name` varchar(64) NOT NULL,
-		`total_time` bigint(20) unsigned NOT NULL default '0',
-		`last_seen` timestamp NOT NULL default CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-		PRIMARY KEY  (`host_id`, `name`),
-		INDEX `name` (`name`))
-		ENGINE=MyISAM
-		COMMENT='Displays when a binary was last seen running on the host';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_hrSystem` (
-		`host_id` int(10) unsigned NOT NULL,
-		`host_type` int(10) unsigned NOT NULL default '0',
-		`host_status` int(10) unsigned NOT NULL default '0',
-		`uptime` int(10) unsigned NOT NULL default '0',
-		`date` timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
-		`initLoadDevice` int(10) unsigned NOT NULL default '0',
-		`initLoadParams` varchar(255) NOT NULL default '',
-		`users` int(10) unsigned NOT NULL default '0',
-		`cpuPercent` int(10) unsigned NOT NULL default '0',
-		`numCpus` int(10) unsigned NOT NULL default '0',
-		`processes` int(10) unsigned NOT NULL default '0',
-		`maxProcesses` int(10) unsigned NOT NULL default '0',
-		`memSize` BIGINT unsigned NOT NULL default '0',
-		`memUsed` FLOAT NOT NULL default '0',
-		`swapSize` BIGINT UNSIGNED NOT NULL default '0',
-		`swapUsed` FLOAT NOT NULL default '0',
-		`sysDescr` varchar(255) NOT NULL default '',
-		`sysObjectID` varchar(128) NOT NULL default '',
-		`sysUptime` int(10) unsigned NOT NULL default '0',
-		`sysName` varchar(64) NOT NULL default '',
-		`sysContact` varchar(128) NOT NULL default '',
-		`sysLocation` varchar(255) NOT NULL default '',
-		PRIMARY KEY  (`host_id`),
-		INDEX `host_type` (`host_type`),
-		INDEX `host_status` (`host_status`))
-		ENGINE=MyISAM
-		COMMENT='Contains all Hosts that support hostMib';");
-
-	db_execute("CREATE TABLE IF NOT EXISTS `plugin_hmib_processes` (
-		`pid` int(10) unsigned NOT NULL,
-		`taskid` int(10) unsigned NOT NULL,
-		`started` timestamp NOT NULL default CURRENT_TIMESTAMP,
-		PRIMARY KEY  (`pid`))
-		ENGINE=MEMORY
-		COMMENT='Running collector processes';");
-
-	db_execute("CREATE TABLE `plugin_hmib_types` (
-		`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
-		`oid` varchar(40) NOT NULL,
-		`description` varchar(30) NOT NULL,
-		PRIMARY KEY (`oid`),
-		INDEX `id`(`id`))
-		ENGINE=MyISAM
-		COMMENT='OID Types for the Host MIB Resources';");
-
-	db_execute("CREATE TABLE `plugin_hmib_hrSystemTypes` (
-		`id` INT(10) unsigned NOT NULL AUTO_INCREMENT,
-		`sysObjectID` VARCHAR(100) NOT NULL,
-		`sysDescrMatch` VARCHAR(100) NOT NULL,
-		`name` VARCHAR(40) NOT NULL,
-		`version` VARCHAR(10) NOT NULL,
-		PRIMARY KEY (`sysObjectID`, `sysDescrMatch`),
-		INDEX `name`(`name`),
-		INDEX `id`(`id`))
-		ENGINE = MyISAM
-		COMMENT='Maps OS Names and Versions to Object ID';");
-
-	db_execute("CREATE TABLE `plugin_hmib_hrSWRun_ignore` (
-		`name` varchar(64) NOT NULL,
-		`enabled` char(2) NOT NULL default '',
-		`notes` varchar(255) NOT NULL default '',
-		PRIMARY KEY  (`name`))
-		ENGINE=MyISAM
-		COMMENT='The process names that we are interested in tracking at the host level';");
-
-	db_execute("INSERT INTO `plugin_hmib_hrSystemTypes` VALUES
-		(1,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Version 6.1','Windows 7','7'),
-		(2,'.1.3.6.1.4.1.311.1.1.3.1.2',  'Version 6.1','Windows 2008 Server','2008'),
-		(3,'.1.3.6.1.4.1.311.1.1.3.1.3',  'Version 6.1','Windows 2008 Domain Contr','2008'),
-		(4,'.1.3',                        'Linux NAS%armv5tejl','DNS-321',''),
-		(5,'.1.3.6.1.4.1.2.3.1.2.1.1.3',  'IBM%AIX%05.03','AIX','5.3'),
-		(6,'.1.3.6.1.4.1.8072.3.2.10',    'Linux%2.6.16.21-0.8%','SUSE','10.2'),
-		(7,'.1.3.6.1.4.1.311.1.1.3.1.1',  'EM64T%Windows Version 5.2','Windows XP x64','5.2'),
-		(8,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Windows 2000 Version 5.0','Windows 2000','5.0'),
-		(9,'.1.3.6.1.4.1.311.1.1.3.1.1',  'Windows 2000 Version 5.1','Windows XP','5.1'),
-		(10,'.1.3.6.1.4.1.8072.3.2.10',   'Linux%2.6.16.60','SUSE','9.0'),
-		(11,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows 2000 Version 5.0','Windows 2000 Server','2000'),
-		(12,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows 2000 Version 5.1','Windows 2000 Server','2000'),
-		(13,'.1.3.6.1.4.1.311.1.1.3.1.3', 'Windows Version 5.2','Windows 2003 DC','2003'),
-		(14,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 5.2','Windows 2003 Server','2003'),
-		(16,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 6.2','Windows 2012 Server','2012'),
-		(17,'.1.3.6.1.4.1.311.1.1.3.1.2', 'Windows Version 6.3','Windows 2016 Server','2016'),
-		(18,'.1.3.6.1.4.1.8072.3.2.10', 'Linux','Linux','Linux'),
-		(19,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%gentoo%','Gentoo Linux','Gentoo'),
-		(20,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%ubuntu%','Ubuntu','ubuntu'),
-		(21,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%centos%','CentOS','CentOS'),
-		(22,'.1.3.6.1.4.1.8072.3.2.10', 'Linux%ndlp%','McAfee Network DLP','DLP'),
-		(23,'.1.3', 'Linux%PAE%','Cisco UCM or CCX','UCM'),
-		(24,'.1.3', 'Identity Services Engine','Cisco ISE','ISE'),
-		(25,'.1.3', 'Cisco Prime Infrastructure','Cisco Prime Infrastructure','Prime'),
-		(26,'.1.3', 'AsyncOS','Cisco Web Security Appliance','WSA'),
-		(27,'.1.3', 'UCOS','Cisco Unity','CUC'),
-		(28,'.1.3.6.1.4.1.2.3.1.2.1.1.3', 'IBM%AIX%06.01%','AIX','6.1'),
-		(29,'', 'VMware ESXi','VMware ESXi','ESXi');");
-
-	db_execute("INSERT INTO `plugin_hmib_types` VALUES
-		(1,'.1.3.6.1.2.1.25.3.1.12','Co-Processor'),
-		(2,'.1.3.6.1.2.1.25.3.1.11','Audio'),
-		(3,'.1.3.6.1.2.1.25.3.1.10','Video'),
-		(4,'.1.3.6.1.2.1.25.3.1.2','Unknown'),
-		(5,'.1.3.6.1.2.1.25.3.1.1','Other'),
-		(6,'.1.3.6.1.2.1.25.3.1.13','Keyboard'),
-		(7,'.1.3.6.1.2.1.25.3.1.3','Processor'),
-		(8,'.1.3.6.1.2.1.25.3.1.4','Network'),
-		(9,'.1.3.6.1.2.1.25.3.1.5','Printer'),
-		(10,'.1.3.6.1.2.1.25.3.1.6','Disk'),
-		(11,'.1.3.6.1.2.1.25.2.1.1','Other Storage'),
-		(12,'.1.3.6.1.2.1.25.2.1.2','Ram Memory'),
-		(13,'.1.3.6.1.2.1.25.2.1.3','Virtual Memory'),
-		(14,'.1.3.6.1.2.1.25.2.1.4','Fixed Disk'),
-		(15,'.1.3.6.1.2.1.25.2.1.5','Removable Disk'),
-		(16,'.1.3.6.1.2.1.25.2.1.6','Floppy Disk'),
-		(17,'.1.3.6.1.2.1.25.2.1.7','Compact Disk'),
-		(18,'.1.3.6.1.2.1.25.2.1.8','Ram Disk'),
-		(19,'.1.3.6.1.2.1.25.2.1.9','Flash Memory'),
-		(20,'.1.3.6.1.2.1.25.2.1.10','Network Disk'),
-		(21,'.1.3.6.1.2.1.25.3.1.14','Modem'),
-		(22,'.1.3.6.1.2.1.25.3.1.18','Tape'),
-		(23,'.1.3.6.1.2.1.25.3.1.15','Parllel Port'),
-		(24,'.1.3.6.1.2.1.25.3.1.16','Pointing'),
-		(25,'.1.3.6.1.2.1.25.3.1.17','Serial Port'),
-		(26,'.1.3.6.1.2.1.25.3.1.19','Clock'),
-		(27,'.1.3.6.1.2.1.25.3.1.20','Volatile Memory'),
-		(28,'.1.3.6.1.2.1.25.3.1.21','Non Volatile Memory'),
-		(29,'.1.3.6.1.2.1.25.3.9.1','Other'),
-		(30,'.1.3.6.1.2.1.25.3.9.2','Unknown'),
-		(31,'.1.3.6.1.2.1.25.3.9.3','BerkleyFS'),
-		(32,'.1.3.6.1.2.1.25.3.9.4','Sys5FS'),
-		(33,'.1.3.6.1.2.1.25.3.9.6','HPFS'),
-		(34,'.1.3.6.1.2.1.25.3.9.7','HFS'),
-		(35,'.1.3.6.1.2.1.25.3.9.8','MFS'),
-		(36,'.1.3.6.1.2.1.25.3.9.10','VNode'),
-		(37,'.1.3.6.1.2.1.25.3.9.11','Journaled'),
-		(38,'.1.3.6.1.2.1.25.3.9.12','iso9660'),
-		(39,'.1.3.6.1.2.1.25.3.9.13','RockRidge'),
-		(40,'.1.3.6.1.2.1.25.3.9.14','NFS'),
-		(41,'.1.3.6.1.2.1.25.3.9.15','Netware'),
-		(42,'.1.3.6.1.2.1.25.3.9.16','AFS'),
-		(43,'.1.3.6.1.2.1.25.3.9.17','DFS'),
-		(44,'.1.3.6.1.2.1.25.3.9.18','AppleShare'),
-		(45,'.1.3.6.1.2.1.25.3.9.19','RFS'),
-		(46,'.1.3.6.1.2.1.25.3.9.20','DGCFS'),
-		(47,'.1.3.6.1.2.1.25.3.9.21','BFS'),
-		(48,'.1.3.6.1.2.1.25.3.9.22','FAT32'),
-		(49,'.1.3.6.1.2.1.25.3.9.23','Ext2'),
-		(50,'.1.3.6.1.2.1.25.3.9.5','FAT'),
-		(51,'.1.3.6.1.2.1.25.3.9.9','NTFS')");
-
-	// optimizations
-	if (!db_index_exists('data_input_data', 'data_template_data_id')) {
-		db_execute('ALTER TABLE data_input_data ADD INDEX data_template_data_id(data_template_data_id)');
-	}
-
-	if (!db_index_exists('data_input_data', 'data_input_field_id')) {
-		db_execute('ALTER TABLE data_input_data ADD INDEX data_input_field_id(data_input_field_id)');
-	}
-
-	if (!db_index_exists('snmp_query_graph', 'graph_template_id')) {
-		db_execute('ALTER TABLE snmp_query_graph ADD INDEX graph_template_id(graph_template_id)');
-	}
-
-	if (!db_index_exists('snmp_query_graph', 'snmp_query_id')) {
-		db_execute('ALTER TABLE snmp_query_graph ADD INDEX snmp_query_id(snmp_query_id)');
-	}
-}
 
 /**
  * Poller_bottom hook: launches the main Host MIB poller process
@@ -998,3 +739,173 @@ function hmib_get_disk(array $host_index): array|string {
 		}
 	}
 }
+
+/**
+ * Removes files and directories that a previous version of this plugin
+ * shipped but that have since moved or been deleted, using the tombstone
+ * and whitelist lists in manifest.json. Whitelisted (user-data) paths and
+ * any VCS metadata (.git*) are never touched; the dev-only tests/ tree is
+ * removed. Any path that resolves outside the plugin directory (a tampered
+ * manifest.json) is refused, and any file/directory that cannot be removed
+ * (e.g. read-only) is reported to the Cacti log. Any top-level entry that is
+ * neither expected nor a tombstone nor whitelisted is logged to the Cacti
+ * log and left in place. Called on a plugin version change.
+ *
+ * @return void
+ *
+ * @global array $config Cacti global configuration array; used to resolve
+ *                       the plugin directory.
+ */
+function hmib_prune_files(): void {
+	global $config;
+
+	$plugin_dir    = $config['base_path'] . '/plugins/hmib';
+	$manifest_path = $plugin_dir . '/manifest.json';
+
+	if (!is_readable($manifest_path)) {
+		return;
+	}
+
+	$manifest = json_decode((string) file_get_contents($manifest_path), true);
+
+	if (!is_array($manifest)) {
+		cacti_log('WARNING: hmib manifest.json could not be parsed; skipping file prune', false, 'HMIB');
+
+		return;
+	}
+
+	$tombstones = isset($manifest['tombstones']) && is_array($manifest['tombstones']) ? $manifest['tombstones'] : [];
+	$expected   = isset($manifest['expected'])   && is_array($manifest['expected'])   ? $manifest['expected']   : [];
+	$whitelist  = isset($manifest['whitelist'])  && is_array($manifest['whitelist'])  ? $manifest['whitelist']  : [];
+
+	$protected = function (string $rel) use ($whitelist): bool {
+		if (strncmp($rel, '.git', 4) === 0 || strncmp($rel, '.md', 3) === 0) {
+			return true;
+		}
+
+		foreach ($whitelist as $entry) {
+			$entry = trim((string) $entry, '/');
+
+			if ($entry !== '' && ($rel === $entry
+				|| strncmp($rel, $entry . '/', strlen($entry) + 1) === 0
+				|| strncmp($entry, $rel . '/', strlen($rel) + 1) === 0)) {
+				return true;
+			}
+		}
+
+		return false;
+	};
+
+	// Security: resolve the plugin directory so a tampered manifest.json
+	// cannot steer the prune outside of it.
+	$plugin_real = realpath($plugin_dir);
+
+	// Remove tombstoned (moved/deleted) paths plus the dev-only tests/
+	// tree and the phpunit.xml test configuration.
+	$remove   = $tombstones;
+	$remove[] = 'tests/';
+	$remove[] = 'phpunit.xml';
+
+	foreach ($remove as $rel) {
+		$rel = trim((string) $rel, '/');
+
+		if ($rel === '' || $protected($rel)) {
+			continue;
+		}
+
+		// A tombstone must never contain '.'/'..' segments; a tampered manifest
+		// could use them to escape the plugin directory or target its root.
+		$segments = explode('/', $rel);
+
+		if (in_array('.', $segments, true) || in_array('..', $segments, true)) {
+			cacti_log(sprintf('WARNING: hmib prune refused to remove %s: path contains a traversal segment (tampered manifest.json?)', $rel), false, 'HMIB');
+
+			continue;
+		}
+
+		$path = $plugin_dir . '/' . $rel;
+
+		if (!is_link($path) && !file_exists($path)) {
+			continue;
+		}
+
+		// Refuse any path that, after resolving symlinks and ../ segments,
+		// escapes the plugin directory (protects user data from a tampered
+		// manifest.json).
+		$anchor = is_link($path) ? dirname($path) : $path;
+		$real   = realpath($anchor);
+
+		if ($real === false || ($real !== $plugin_real && strncmp($real, $plugin_real . DIRECTORY_SEPARATOR, strlen((string) $plugin_real) + 1) !== 0)) {
+			cacti_log(sprintf('WARNING: hmib prune refused to remove %s: path resolves outside the plugin directory (tampered manifest.json?)', $rel), false, 'HMIB');
+
+			continue;
+		}
+
+		if (is_dir($path) && !is_link($path)) {
+			$removed = hmib_rmtree($path);
+		} else {
+			$removed = @unlink($path);
+		}
+
+		if (!$removed) {
+			cacti_log(sprintf('WARNING: hmib upgrade could not remove %s (check file/directory permissions)', $rel), false, 'HMIB');
+		}
+	}
+
+	// Surface any top-level entry the manifest does not account for.
+	$known = [];
+
+	foreach (array_merge($expected, $tombstones) as $entry) {
+		$top = explode('/', trim((string) $entry, '/'))[0];
+
+		if ($top !== '') {
+			$known[$top] = true;
+		}
+	}
+
+	$entries = scandir($plugin_dir);
+
+	foreach (($entries !== false ? $entries : []) as $entry) {
+		if ($entry === '.' || $entry === '..' || $entry === 'tests' || $entry === 'phpunit.xml' || $protected($entry) || isset($known[$entry])) {
+			continue;
+		}
+
+		cacti_log(sprintf('WARNING: hmib upgrade found a file/directory not described in manifest.json: %s (left in place)', $entry), false, 'HMIB');
+	}
+}
+
+/**
+ * Recursively deletes a directory and its contents. Symlinks are removed
+ * without being followed. Helper for hmib_prune_files().
+ *
+ * @param string $dir Absolute path to the directory to remove.
+ *
+ * @return bool True if the directory and everything under it was removed;
+ *              false if any entry could not be deleted.
+ */
+function hmib_rmtree(string $dir): bool {
+	$entries = scandir($dir);
+	$ok      = true;
+
+	foreach (($entries !== false ? $entries : []) as $entry) {
+		if ($entry === '.' || $entry === '..') {
+			continue;
+		}
+
+		$path = $dir . '/' . $entry;
+
+		if (is_dir($path) && !is_link($path)) {
+			if (!hmib_rmtree($path)) {
+				$ok = false;
+			}
+		} elseif (!@unlink($path)) {
+			$ok = false;
+		}
+	}
+
+	if (!@rmdir($dir)) {
+		$ok = false;
+	}
+
+	return $ok;
+}
diff --git a/tests/Security/IndexGuardConsistencyTest.php b/tests/Security/IndexGuardConsistencyTest.php
index 65b141e..17c14e9 100644
--- a/tests/Security/IndexGuardConsistencyTest.php
+++ b/tests/Security/IndexGuardConsistencyTest.php
@@ -23,7 +23,7 @@
  */
 
 it('checks the same index name it creates for every guarded ADD INDEX in hmib_setup_table()', function () {
-	$source = plugin_test_read_source('setup.php');
+	$source = plugin_test_read_source('includes/database.php');
 
 	preg_match('/function hmib_setup_table\(\).*?\n}/s', $source, $function_match);
 	expect($function_match[0] ?? null)->not->toBeNull();
diff --git a/tests/Unit/HmibLifecycleTest.php b/tests/Unit/HmibLifecycleTest.php
index 94a6e4e..eea7516 100644
--- a/tests/Unit/HmibLifecycleTest.php
+++ b/tests/Unit/HmibLifecycleTest.php
@@ -36,6 +36,21 @@
 	$GLOBALS['__test_db_calls']            = array();
 	$GLOBALS['__test_enabled_hooks_calls'] = array();
 	test_set_current_page('hmib.php');
+
+	// Sandbox base_path so any upgrade-path test (hmib_check_upgrade drifts and
+	// runs hmib_prune_files) operates on a throwaway tree with a minimal
+	// INFO, never the real checkout.
+	$GLOBALS['__hmib_base_restore'] = $GLOBALS['config']['base_path'];
+	$base = sys_get_temp_dir() . '/hmib-test-' . uniqid();
+	mkdir($base . '/plugins/hmib', 0777, true);
+	file_put_contents($base . '/plugins/hmib/INFO', "[info]\nversion = 9.9.9\nname = hmib\nlongname = Host MIB\nauthor = x\nhomepage = x\n");
+	$GLOBALS['config']['base_path'] = $base;
+});
+
+afterEach(function () {
+	if (isset($GLOBALS['__hmib_base_restore'])) {
+		$GLOBALS['config']['base_path'] = $GLOBALS['__hmib_base_restore'];
+	}
 });
 
 it('reports the config as always valid', function () {
diff --git a/tests/Unit/PruneFilesTest.php b/tests/Unit/PruneFilesTest.php
new file mode 100644
index 0000000..d61bd9c
--- /dev/null
+++ b/tests/Unit/PruneFilesTest.php
@@ -0,0 +1,255 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDtool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * Unit coverage for hmib_prune_files(): tombstone/tests removal,
+ * whitelist and .git protection, and logging of unaccounted-for entries.
+ */
+
+require_once __DIR__ . '/../../setup.php';
+
+function hmib_prune_fixture(array $manifest): string {
+	$base   = sys_get_temp_dir() . '/hmib-prune-' . uniqid();
+	$plugin = $base . '/plugins/hmib';
+
+	mkdir($plugin . '/include', 0777, true);
+	file_put_contents($plugin . '/include/old.php', "<?php\n");
+	mkdir($plugin . '/tests/Unit', 0777, true);
+	file_put_contents($plugin . '/tests/Unit/SomeTest.php', "<?php\n");
+	mkdir($plugin . '/userdata', 0777, true);
+	file_put_contents($plugin . '/userdata/keep.dat', 'keep');
+	mkdir($plugin . '/includes', 0777, true);
+	file_put_contents($plugin . '/INFO', "[info]\n");
+	file_put_contents($plugin . '/setup.php', "<?php\n");
+	file_put_contents($plugin . '/oldfile.php', "<?php\n");
+	file_put_contents($plugin . '/stray.php', "<?php\n");
+	file_put_contents($plugin . '/phpunit.xml', '');
+	file_put_contents($plugin . '/.mdlrc', '');
+	file_put_contents($plugin . '/.md_style.rb', '');
+	mkdir($plugin . '/.git', 0777, true);
+	file_put_contents($plugin . '/.git/config', '');
+	file_put_contents($plugin . '/manifest.json', json_encode($manifest));
+
+	return $base;
+}
+
+beforeEach(function () {
+	$GLOBALS['__test_cacti_log'] = [];
+});
+
+it('removes tombstoned paths and the tests/ tree, keeps whitelist/.git/expected, logs strays', function () {
+	$manifest = [
+		'tombstones' => ['include/', 'oldfile.php', 'userdata/', 'gone.png'],
+		'expected'   => ['INFO', 'setup.php', 'includes/', 'manifest.json'],
+		'whitelist'  => ['userdata/'],
+	];
+
+	$base    = hmib_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/hmib';
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// Tombstone and the dev-only tests/ tree are gone.
+	expect(is_dir($plugin . '/include'))->toBeFalse();
+	expect(is_dir($plugin . '/tests'))->toBeFalse();
+	expect(is_file($plugin . '/oldfile.php'))->toBeFalse();
+	expect(is_file($plugin . '/phpunit.xml'))->toBeFalse();
+
+	// Whitelisted user data, VCS metadata, and expected files are untouched.
+	// (userdata/ is even listed as a tombstone, but the whitelist wins.)
+	expect(is_file($plugin . '/userdata/keep.dat'))->toBeTrue();
+	expect(is_dir($plugin . '/.git'))->toBeTrue();
+	expect(is_file($plugin . '/INFO'))->toBeTrue();
+	expect(is_dir($plugin . '/includes'))->toBeTrue();
+	expect(is_file($plugin . '/.mdlrc'))->toBeTrue();
+	expect(is_file($plugin . '/.md_style.rb'))->toBeTrue();
+
+	// An unexpected, non-whitelisted stray is left in place but logged.
+	expect(is_file($plugin . '/stray.php'))->toBeTrue();
+
+	$logged = implode("\n", $GLOBALS['__test_cacti_log']);
+	expect($logged)->toContain('stray.php');
+	expect($logged)->not->toContain('userdata');
+	expect($logged)->not->toContain('.git');
+	expect($logged)->not->toContain('.mdlrc');
+	expect($logged)->not->toContain('.md_style.rb');
+});
+
+it('is a safe no-op when the manifest is missing', function () {
+	$base    = sys_get_temp_dir() . '/hmib-prune-missing-' . uniqid();
+	mkdir($base . '/plugins/hmib', 0777, true);
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	expect($GLOBALS['__test_cacti_log'])->toBe([]);
+});
+
+it('logs and skips pruning when the manifest is malformed', function () {
+	$base   = sys_get_temp_dir() . '/hmib-prune-bad-' . uniqid();
+	$plugin = $base . '/plugins/hmib';
+	mkdir($plugin, 0777, true);
+	file_put_contents($plugin . '/manifest.json', 'not json');
+	mkdir($plugin . '/tests', 0777, true);
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// A malformed manifest must not delete anything.
+	expect(is_dir($plugin . '/tests'))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('could not be parsed');
+});
+
+it('refuses to remove a tombstone that resolves outside the plugin directory', function () {
+	$manifest = [
+		'tombstones' => ['../escapee.txt'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base    = hmib_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/hmib';
+	$outside = $base . '/plugins/escapee.txt';
+	file_put_contents($outside, 'precious user data');
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// The out-of-tree file is untouched and the refusal is logged.
+	expect(is_file($outside))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('a traversal segment');
+});
+
+it('warns when a tombstoned path cannot be removed', function () {
+	$manifest = [
+		'tombstones' => ['locked/'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base   = hmib_prune_fixture($manifest);
+	$plugin = $base . '/plugins/hmib';
+	mkdir($plugin . '/locked/sub', 0777, true);
+	file_put_contents($plugin . '/locked/sub/data', 'x');
+	chmod($plugin . '/locked/sub', 0500); // read-only dir: its child cannot be unlinked
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	set_error_handler(static fn () => true); // swallow the expected unlink warning
+
+	try {
+		hmib_prune_files();
+	} finally {
+		restore_error_handler();
+		$GLOBALS['config']['base_path'] = $restore;
+		@chmod($plugin . '/locked/sub', 0700);
+	}
+
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('could not remove');
+})->skip(function () {
+	return function_exists('posix_getuid') && posix_getuid() === 0;
+}, 'permission checks are bypassed for the root user');
+
+it('refuses a tombstone that escapes through a symlinked directory', function () {
+	$manifest = [
+		'tombstones' => ['escdir/secret.txt'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => [],
+	];
+
+	$base    = hmib_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/hmib';
+	$outside = $base . '/outside';
+	mkdir($outside, 0777, true);
+	file_put_contents($outside . '/secret.txt', 'precious user data');
+	@symlink($outside, $plugin . '/escdir');
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// The out-of-tree file reached through the symlink is untouched and logged.
+	expect(is_file($outside . '/secret.txt'))->toBeTrue();
+	expect(implode("\n", $GLOBALS['__test_cacti_log']))->toContain('outside the plugin directory');
+})->skip(function () {
+	$probe = sys_get_temp_dir() . '/.prune-symlink-probe-' . uniqid();
+	$ok = @symlink(__FILE__, $probe);
+	@unlink($probe);
+
+	return $ok === false;
+}, 'symlinks are not supported on this filesystem');
+
+it('protects a whitelisted file from a tombstone on its parent directory', function () {
+	$manifest = [
+		'tombstones' => ['userdata/'],
+		'expected'   => ['manifest.json'],
+		'whitelist'  => ['userdata/keep.dat'],
+	];
+
+	$base    = hmib_prune_fixture($manifest);
+	$plugin  = $base . '/plugins/hmib';
+	$restore = $GLOBALS['config']['base_path'];
+
+	$GLOBALS['config']['base_path'] = $base;
+
+	try {
+		hmib_prune_files();
+	} finally {
+		$GLOBALS['config']['base_path'] = $restore;
+	}
+
+	// A whitelisted file shields its parent directory from a tombstone.
+	expect(is_file($plugin . '/userdata/keep.dat'))->toBeTrue();
+});
diff --git a/tests/bin/validate-manifest.php b/tests/bin/validate-manifest.php
new file mode 100644
index 0000000..c54fab5
--- /dev/null
+++ b/tests/bin/validate-manifest.php
@@ -0,0 +1,73 @@
+<?php
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ +-------------------------------------------------------------------------+
+ | Validates that manifest.json's "expected" array matches the plugin's    |
+ | actual top-level tree, so the manifest that drives upgrade-time pruning  |
+ | cannot silently drift. tests/, phpunit.xml, .git* and .md* are          |
+ | excluded, as are whitelisted (user-data) paths. Non-zero exit on drift. |
+ +-------------------------------------------------------------------------+
+*/
+
+$root         = dirname(__DIR__, 2);
+$manifestPath = $root . '/manifest.json';
+
+if (!is_readable($manifestPath)) {
+	fwrite(STDERR, "manifest.json not found at plugin root\n");
+	exit(1);
+}
+
+$manifest = json_decode((string) file_get_contents($manifestPath), true);
+
+if (!is_array($manifest) || !isset($manifest['expected']) || !is_array($manifest['expected'])) {
+	fwrite(STDERR, "manifest.json is missing a valid 'expected' array\n");
+	exit(1);
+}
+
+$whitelist    = isset($manifest['whitelist']) && is_array($manifest['whitelist']) ? $manifest['whitelist'] : [];
+$whitelistTop = [];
+
+foreach ($whitelist as $entry) {
+	$entry = trim((string) $entry, '/');
+
+	if ($entry !== '') {
+		$whitelistTop[explode('/', $entry)[0]] = true;
+	}
+}
+
+$actual = [];
+
+foreach (scandir($root) as $entry) {
+	if ($entry === '.' || $entry === '..' || $entry === 'tests' || $entry === 'phpunit.xml') {
+		continue;
+	}
+
+	if (strncmp($entry, '.git', 4) === 0 || strncmp($entry, '.md', 3) === 0 || isset($whitelistTop[$entry])) {
+		continue;
+	}
+
+	$actual[] = is_dir($root . '/' . $entry) ? $entry . '/' : $entry;
+}
+
+$expected = $manifest['expected'];
+sort($actual);
+sort($expected);
+
+$missing = array_values(array_diff($expected, $actual));
+$extra   = array_values(array_diff($actual, $expected));
+
+if ($missing === [] && $extra === []) {
+	echo "manifest.json 'expected' matches the plugin tree.\n";
+	exit(0);
+}
+
+if ($missing !== []) {
+	fwrite(STDERR, "manifest.json lists 'expected' entries that are missing on disk:\n  " . implode("\n  ", $missing) . "\n");
+}
+
+if ($extra !== []) {
+	fwrite(STDERR, "Plugin tree has top-level entries not in manifest.json 'expected'\n(add them to 'expected', or record them under 'tombstones'/'whitelist'):\n  " . implode("\n  ", $extra) . "\n");
+}
+
+exit(1);
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 0a920e8..bf37e18 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -289,6 +289,8 @@ function __esc($text, $domain = '') {
 
 if (!function_exists('cacti_log')) {
 	function cacti_log($message, $also_print = false, $log_type = '', $level = 0) {
+		$args = func_get_args();
+		$GLOBALS["__test_cacti_log"][] = isset($args[0]) ? (string) $args[0] : "";
 	}
 }