[edgehero]

Part 3 of #712. Part 1 (#722) is merged. The console used to say "run pi-dispatch doctor for the reason". It now shows each host's latest doctor result.

How results are published

• Every doctor run publishes. Each pi-dispatch doctor run, including the doctor step of up, writes one record per host to doctor:h:<host>. It is JSON, written with SET PX for 7 days, and indexed in doctor:hosts.
  • Publishing is best-effort. It never changes doctor's exit code or its stdout.
  • --no-publish turns it off.
• The worker reruns doctor. It spawns doctor a minute after boot, then every PI_DOCTOR_INTERVAL_HOURS (default 24, 0 turns it off, maximum 168).
  • It never passes --live, --secrets or --fix, and runs never overlap.
  • It kills the doctor process group at 120 s, and at shutdown.
• The record says who ran it (by: { uid, worker }), so a sudo run is labelled and cannot pass for the worker's own.
• Nothing reads doctor:* to decide anything, so deleting those keys changes nothing.

What a published check contains

A passing check is just its id and its level. Failing and warning checks also carry a label and a fix, redacted before the length cap:

• paths, file URLs, scp-style and UNC forms become <path>;
• a URL keeps only its scheme, host and port;
• the input that a JSON.parse error quotes becomes <content>;
• these all become [redacted]: credential query parameters, assignments, flags and headers; the value of any secret-named env variable; known token shapes;
• invisible characters are deleted first, so they cannot split a token.

Tests seed a provider key and a Valkey password and check that neither appears in the published record.

What the console and panel show

• Fleet page: a new Doctor panel shows, per host, its failing checks first. It marks a stale result, and names a live host that has never published.
• "Does not load" sentences quote this host's own check first, and another host's only when this host has none.
• /dispatch hosts view: shows the same doctor lines.

Specs

• New: DES-DOCTOR-RESULTS-PUBLISHED, INT-DOCTOR-RESULTS-KEY.
• Amended: DES-OPERATOR-CONSOLE; DES-CLI-SURFACE, since doctor now makes one write, its own results; INT-HOST-REGISTRY-CONTRACT; REQ-OPERATOR-CONSOLE-SCREENS; REQ-DEPLOYMENT-BOOTSTRAP.
• UNCHANGED, checked: REQ-CONSOLE-SECURITY, REQ-ADMIN-VIA-PI-EXTENSION, DES-RETENTION-SWEEPS-ON-A-TIMER, INT-CONSOLE-STATE-API.

Residuals (named in the DES entry)

• Fullwidth slashes and relative paths are kept as written.
• The user name in an scp-style path is kept.
• A doctor child started before a worker crash outlives the worker until its own time limits stop it.

Verification

• Review: two adversarial rounds, every finding fixed.
• Full suite with Valkey: 9628 tests, 2 failures, both known (the macOS mcp test, and a service.test.mjs SIGTERM timing test under load).
• Build and checks: node admin/build.mjs builds, and the revision-row, test-count, temp-dir and dated-fixture checks pass.