One command, designed to run on a schedule in CI, that answers the questions nobody remembers to ask:
Is any vault down to one member?
Is anyone in a protected vault still holding a plain file key?
How old is the newest backup mirror?
Has anything gone stale: checkpoints, drills, rehearsals?
Does the audit log agree with what this machine actually did?
Is every grant still compliant with its vault's policy?
If any answer is bad, the command fails, and a CI pipeline running it fails with it. That is the point: problems block the build instead of waiting to be noticed.