# Doctor and update awareness

`reckon doctor` reports:

- package, CLI, source, and MCP server version agreement;
- current Node runtime and npm prefix;
- manager ownership with confidence and evidence;
- resolved executable, symlink/shim chain, and duplicate candidates;
- supported agent configuration candidates;
- a real MCP initialize/tools-list result;
- Git-hook routing and refresh health;
- graph health;
- configured registry/channel;
- cached latest **trusted** release state; and
- the manager-safe action boundary when a signed update is known.

A manager is reported as known only from manager-owned environment evidence or
an identified shim. A path substring is labeled a medium-confidence heuristic,
not proof.

The former npm `latest` lookup has been removed from production paths. Doctor,
CLI status, and MCP status now consume the same signed-only state as:

```bash
reckon update status
reckon update check
reckon update explain
reckon update apply
reckon update rollback
```

Until the production root ceremony embeds an independently reviewed root and
pin, these commands report `trust-unconfigured` and make no request. A user
configuration file containing both a root path and its digest is deliberately
inert: accepting both from one mutable file would not be independent pinning.

After activation, an interactive ordinary command may atomically claim a due
background check. The foreground command does not wait for the network.
Metadata requests have a 512 KiB per-role cap, a 100 ms–10 s configured
timeout, no redirects, and remain within one approved HTTPS origin and path.
Disable checks or all network access with:

```bash
RECKON_UPDATE_CHECK=0 reckon doctor
RECKON_OFFLINE=1 reckon update check
```

Requests contain fixed metadata or signed target paths only. They never contain
a repository name, source path, symbol, command, username, or telemetry. A
failed check retains the last verified monotonic state but reports
`check-failed`; it never turns failure into `up-to-date`.

Apply is opt-in and fails closed. It verifies threshold-signed metadata,
release age/channel/version policy, artifact length and SHA-256, a signed
provenance digest, configured channel cross-checks, and both candidate and
rollback artifacts before any manager action. Artifacts are quarantined with
private permissions, fresh exclusive paths, and a symlink-rejecting quarantine
root. Every enterprise-only primary or cross-check origin must be explicitly
approved. Only a plain npm-owned install currently has an exact local-artifact
adapter; mise, Volta, nvm/fnm/asdf, Homebrew, and unknown ownership remain
`manager-action-required` until their rollback-safe adapters are certified. No
manager is ever asked to resolve a mutable version or tag, and a rollback is not
reported successful until the restored installation passes its health check.

Automatic activation also requires a certified sandbox smoke test. None is
enabled in the production CLI yet, so `apply-patch`/`apply-minor` policies stop
after verified quarantine instead of executing untrusted code. C64 supplies
the provenance/SBOM and five-channel attestation machinery; the production
release must populate it, and C65 must supply compromised-channel and recovery
evidence before this gate can open.

Run `reckon status --deep` for graph details and `reckon repair` for surgical
repair. Re-run `reckon init` after changing the executable owner or MCP path.

## Query availability

Every graph read reports an explicit availability outcome. `no-match` means a
healthy graph was queried and produced no match. It is distinct from
`not-initialized`, `empty-repository`, `empty-index`, `repair-needed`,
`indexing`, and `unknown`; those states fail closed and include remediation
instead of returning an ordinary zero. An otherwise complete graph with broken
or displaced lifecycle hooks remains queryable but reports
`lifecycle-degraded`, so callers can use current evidence without mistaking its
refresh path for healthy.