Diagnose and repair

When a node stops working, or something is off after a reboot, run:

psm doctor

It checks item by item (ok / warning / critical / skipped) and ends by telling you how many problems it can repair.

Repairing

psm doctor --fix

Everything it knows a safe repair for gets repaired, and then everything is checked again:

Problem	Repair
A core service stopped	config checked, then restarted; a missing service definition is written first
A core still runs as root	moved to the unprivileged user psm-core
Not started at boot	re-enabled
Port-hopping redirect rules lost	rebuilt from the node records
curl, jq or openssl missing	installed; a jq that is too old (1.6) is replaced
A certificate about to expire	renewed through acme.sh
Disk nearly full	journal, oversized PSM logs and the package cache cleaned

A config file with errors is only reported, never rewritten, so a repair cannot make things worse. --fix needs root.

For scripts and monitoring

psm doctor --json

Structured JSON; exit code 0 healthy, 1 something critical, 2 usage error. Plug it into your own monitoring or cron jobs.