Problem. On a docs-faithful fresh machine doctor reports 31 FAILs and several of its own remedies do not converge: (a) bw not in PATH — run 'dotf tools install' → that command fails identically (bw is npm:@bitwarden/cli in packages.json; npm is only an "optional dependency" — see #649 for a native-binary source); (b) [SKIP] … run secrets_refresh → function retired in #587; (c) doctor --fix prints "Applied 11 fix action(s)" when it only PRINTED profile-export suggestions — and those suggestions, if followed, permanently shadow machine.json via cascade rule #1 (ADR-025 footgun); (d) orphan: <file>.secret.age (no registry entry) FAILs with no owning command to adopt or remove the file (live on this box: kubelab-dispatch-token.secret.age).
Acceptance: every fix_suggestion is executable verbatim and flips its check on re-run (meta-test candidate); "applied" counts only real wiring actions; env suggestions point at sourcing paths.sh / machine.json, not raw exports.
Repro: E2 S3-S5, E3 T7; real-machine doctor run in the audit.
Source: docs/audits/process-audit-2026-07-07.md §4 P6+P8+P13 (CONFIRMED).
Problem. On a docs-faithful fresh machine doctor reports 31 FAILs and several of its own remedies do not converge: (a)
bw not in PATH — run 'dotf tools install'→ that command fails identically (bw isnpm:@bitwarden/cliin packages.json; npm is only an "optional dependency" — see #649 for a native-binary source); (b)[SKIP] … run secrets_refresh→ function retired in #587; (c)doctor --fixprints "Applied 11 fix action(s)" when it only PRINTED profile-export suggestions — and those suggestions, if followed, permanently shadow machine.json via cascade rule #1 (ADR-025 footgun); (d)orphan: <file>.secret.age (no registry entry)FAILs with no owning command to adopt or remove the file (live on this box: kubelab-dispatch-token.secret.age).Acceptance: every fix_suggestion is executable verbatim and flips its check on re-run (meta-test candidate); "applied" counts only real wiring actions; env suggestions point at sourcing paths.sh / machine.json, not raw exports.
Repro: E2 S3-S5, E3 T7; real-machine doctor run in the audit.
Source: docs/audits/process-audit-2026-07-07.md §4 P6+P8+P13 (CONFIRMED).