### `wai doctor`: whether this machine can run the toolchain

- **`wai doctor`** (`toolchain.doctor`, also the tool `toolchain_doctor` of `wai mcp`), one check to a
  line, and with `--json` the envelope. Each check is `pass`, `fail` with its `fix`, `not-checked`
  with the reason, or `not-applicable`; a check that could not be run is never a pass. `result` says
  `passed`, `failed` or `passed-with-not-checked`. It exits 1 when a check failed and 0 otherwise.
- **What it looks at.** This `wai`'s version and path, and whether `wai` at a prompt reaches it: each
  `wai` earlier on `PATH` is asked `--version --json` with a short timeout, and one that does not
  answer as WAI's does is a finding, as is one that hangs; one reached through a relative entry of
  `PATH` is named and not run. The relay and the room service, found as `wai dev` finds them, and
  whether each is of this `wai`'s toolchain. The room client's files and Studio's. Each row of
  [the quickstart's port table](quickstart/README.md), compiled in, free or held by what the system
  names to this account. Browsers for Studio and for the browser harnesses: each found is asked
  `--version` alone, with the same timeout, and runs (naming its version), does not run, or gives no
  answer, and a check passes only on one that runs. One that would open a window to answer is not
  started and says so: a WebKit browser, and on Windows any windowed program. Where `wai key` keeps keys, and whether the directory and each file are this account's alone, on
  Unix by mode and owner and on Windows by SID, with the command that fixes each.
- **On macOS** it asks the keychain tool for its search list, which opens no keychain, and whether
  the login keychain is unlocked always reads not checked, since asking can raise a prompt. It
  reads no secret and opens no seed file.
- **What it leaves alone.** Nothing is sent off the machine, and nothing is written. Each program it
  asks has a few seconds, then is stopped with all it started, and when it answers in time, what it
  left running is ended too: on Linux and macOS its process group, ended once it has exited and
  before it is reaped, so the group's number is still its own; on Windows a job object it enters
  before it runs.
  The run ends within a few seconds whatever a probe is waiting on: a group of checks that has not
  finished reads as not checked.
- **Each platform's quickstart archive is checked with it** where it is built: from the unpacked
  archive, its `bin` first on `PATH`, every `install` and `stack` check must pass
  ([quickstart/test/archive_doctor.py](quickstart/test/archive_doctor.py)), and the ports and browsers,
  which depend on the machine, are printed.
- **`doctor` joins the verbs** of naming rule N3 ([catalogue/README.md](catalogue/README.md)).
- **`wai-relay --version` and `wai-room --version`**, with `--json` for the envelope, name the
  program's own version and the toolchain it belongs to (joule-code's changelog).
