fix(doctor): four checks that lied, and none of them about a real fault #40

Merged

dan-claude-bot merged 1 commit from fix/doctor-lies into main

2026-07-14 11:28:24 +00:00

dan-claude-bot commented

2026-07-14 02:24:22 +00:00

(Migrated from github.com)

Run doctor.sh on a healthy host and it reports three problems — all of them its own:

It said	The truth
`DIRTY dns.mode = none ← the drill's phase D left this behind`	`dns.mode=none` is now the shipped setting — it is what stops a box enumerating its siblings (#37). Its absence is the fault. The doctor was "fixing" the fix away.
`DIRTY the box-to-box drop is MISSING`	It is right there. The check used `sudo -n`, which fails without cached credentials. `sudo nft list table bridge claudebox` shows the table plainly.
`'bridge' (iproute2) not installed — cannot read the kernel's view`	It is installed. It lives in `/usr/sbin`, which is not on a normal user's `PATH`. This was the one check that could settle the isolation question, and it skipped itself.
`no box to probe with`	Two boxes were `RUNNING`. The probe only looked for the drill's own box names.

A diagnostic that cries wolf is worse than no diagnostic. It costs the same trust as a real failure and teaches you to ignore it — and I have now shipped four of them in one file, in a session whose entire lesson is measure, don't reason.

All four now report what is actually true, and the kernel's isolated on|off flag — the fact that decides whether boxes are isolated — is finally readable.

🤖 Generated with Claude Code

Run `doctor.sh` on a healthy host and it reports three problems — **all of them its own**: | It said | The truth | | --- | --- | | `DIRTY dns.mode = none ← the drill's phase D left this behind` | `dns.mode=none` is now the **shipped** setting — it is what stops a box enumerating its siblings (#37). Its *absence* is the fault. The doctor was "fixing" the fix away. | | `DIRTY the box-to-box drop is MISSING` | It is right there. The check used `sudo -n`, which fails without cached credentials. `sudo nft list table bridge claudebox` shows the table plainly. | | `'bridge' (iproute2) not installed — cannot read the kernel's view` | It **is** installed. It lives in `/usr/sbin`, which is not on a normal user's `PATH`. This was the one check that could settle the isolation question, and it skipped itself. | | `no box to probe with` | Two boxes were `RUNNING`. The probe only looked for the drill's own box names. | **A diagnostic that cries wolf is worse than no diagnostic.** It costs the same trust as a real failure and teaches you to ignore it — and I have now shipped four of them in one file, in a session whose entire lesson is *measure, don't reason*. All four now report what is actually true, and the kernel's `isolated on|off` flag — the fact that decides whether boxes are isolated — is finally readable. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#40

No description provided.