diff --git a/proxmox/perf/scripts/audit-guest-io.sh b/proxmox/perf/scripts/audit-guest-io.sh
new file mode 100644
index 0000000..c5f8a8f
--- /dev/null
+++ b/proxmox/perf/scripts/audit-guest-io.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/bash
+# Audit VM disk cache from inside guests — confirm writeback visible + I/O perf
+set -uo pipefail
+source "$(cd "$(dirname "$0")/../../.." && pwd)/k8s/env.sh"
+
+echo "=== CNODES (via Tailscale) ==="
+for ip in "${ALL_CNODES[@]}"; do
+  echo "--- $ip ---"
+  # shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
+  cn "$ip" '
+    echo "  write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
+    echo "  scheduler: $(cat /sys/block/sda/queue/scheduler 2>/dev/null)"
+    echo "  fsync (5x 1KB):"
+    for i in 1 2 3 4 5; do
+      t0=$(date +%s%N)
+      dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
+      t1=$(date +%s%N)
+      echo -n " $(( (t1-t0)/1000000 )) ms"
+    done
+    echo
+    rm -f /tmp/.ft
+  ' 2>&1 || echo "  UNREACHABLE"
+done
+
+echo ""
+echo "=== DNS INFRA VMs ==="
+for host in netinfra01 netinfra02; do
+  echo "--- $host ---"
+  # shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
+  netinfra/dns-cluster-setup/remote-dns.sh "$host-root" '
+    echo "  write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
+    echo "  fsync (3x 1KB):"
+    for i in 1 2 3; do
+      t0=$(date +%s%N)
+      dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
+      t1=$(date +%s%N)
+      echo -n " $(( (t1-t0)/1000000 )) ms"
+    done
+    echo
+    rm -f /tmp/.ft
+  ' 2>&1 || echo "  UNREACHABLE"
+done
diff --git a/proxmox/perf/scripts/deploy-tuned-guests.sh b/proxmox/perf/scripts/deploy-tuned-guests.sh
new file mode 100644
index 0000000..5ffb60c
--- /dev/null
+++ b/proxmox/perf/scripts/deploy-tuned-guests.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/bash
+# Deploy tuned inside VMs via qm guest exec (no SSH needed)
+# Uses Proxmox qemu-guest-agent for out-of-band command execution
+set -uo pipefail
+
+# Profile mapping: most VMs get throughput-performance, k8s/network-sensitive get network-latency
+PROFILE="${1:-throughput-performance}"
+
+deploy_vm() {
+  local host="$1" vmid="$2" name="$3"
+  echo -n "  VMID $vmid ($name) on $host: "
+  PROX_HOST=$host bash tests/remote.sh prox "
+    # Check if guest agent is available
+    if ! qm guest cmd \$vmid ping >/dev/null 2>&1; then
+      echo 'NO GUEST AGENT - skip'
+      exit 0
+    fi
+    # Install tuned
+    result=\$(qm guest exec \$vmid --timeout 120 -- /bin/sh -c 'DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>/dev/null; DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tuned 2>/dev/null; tuned-adm profile $PROFILE 2>/dev/null; systemctl enable tuned 2>/dev/null; systemctl restart tuned 2>/dev/null; tuned-adm active 2>/dev/null' 2>/dev/null)
+    if echo \"\$result\" | grep -q 'Current active'; then
+      echo \"\$result\" | grep -o 'Current active.*' | head -1
+    else
+      echo 'INSTALL FAILED (apt issue or no network)'
+    fi
+  " 2>&1
+}
+
+echo "============================================"
+echo "  Deploying tuned ($PROFILE) to VMs"
+echo "============================================"
+echo ""
+
+# tsys1 VMs
+echo "--- pfv-tsys1 ---"
+deploy_vm pfv-tsys1 100 pfv-bms
+deploy_vm pfv-tsys1 101 tsys-ca
+deploy_vm pfv-tsys1 102 pfv-k8s-cnode1
+deploy_vm pfv-tsys1 104 tsys-librenms
+deploy_vm pfv-tsys1 105 tsys-proxmox-datacenter
+deploy_vm pfv-tsys1 108 tsys-ucs-01
+
+# tsys3 VMs
+echo "--- pfv-tsys3 ---"
+deploy_vm pfv-tsys3 313 pfv-k8s-wnode-tsys3
+
+# tsys6 VMs
+echo "--- pfv-tsys6 ---"
+deploy_vm pfv-tsys6 600 tsys-awx
+deploy_vm pfv-tsys6 601 pfv-k8s-wnode-tsys6
+deploy_vm pfv-tsys6 602 pfv-rr-middleware-02
+deploy_vm pfv-tsys6 603 pfv-k8s-cnode3
+deploy_vm pfv-tsys6 604 tsys-proxmox-mailgw-01
+
+# tsys7 VMs
+echo "--- pfv-tsys7 ---"
+deploy_vm pfv-tsys7 701 pfv-k8s-wnode-tsys7
+deploy_vm pfv-tsys7 702 hfnoc-uisp
+deploy_vm pfv-tsys7 703 rr-middleware-01
+deploy_vm pfv-tsys7 705 pfv-k8s-cnode2
+deploy_vm pfv-tsys7 706 kali-rd
+deploy_vm pfv-tsys7 707 tsys-siem
+deploy_vm pfv-tsys7 708 kali-tsys
+deploy_vm pfv-tsys7 709 tsys-voip
+deploy_vm pfv-tsys7 711 tsys-proxmox-mailgw-02
+
+# tsys9 VMs
+echo "--- pfv-tsys9 ---"
+deploy_vm pfv-tsys9 902 tsys-ucs-02
+deploy_vm pfv-tsys9 905 pfv-k8s-wnode-tsys9
+
+echo ""
+echo "============================================"
+echo "  Deployment complete."
+echo "  NOT deployed (do-not-reboot VMs):"
+echo "    ultix-streaming, ultix-offstage,"
+echo "    pfv-netinfra-01, pfv-netinfra-02"
+echo "============================================"