A diff between what the provisioning script installs and what is actually on the host.
$ ssh app-1 'dpkg-query -W -f="${Package}n"' | sort > /tmp/actual
$ ./bin/provision --list-packages | sort > /tmp/declared
$ comm -23 /tmp/actual /tmp/declared
htop
jq
ncdu
percona-toolkit
redis-tools
sysstat
...Six of the eleven are diagnostic tools somebody installed at three in the morning and are worth declaring rather than removing — an incident is not the time to discover jq is missing. The other five were genuine leftovers, including a MySQL client at a version that no longer matched the server. The diff is now part of the monthly rebuild check.