berth updates

berth/ctrl/check.sh

@@ -80,11 +80,27 @@ for r in fw:
     if n: print("        UNRESOLVED: " + n)
 '
 note "listener side: unknown until captured (ss -ltnp over ssh $HOST)."
-wg=$(estate_get "vpn._status")
-[ -n "$wg" ] && warn "overlay: not fully captured — see 'make vpn check'" && \
-    note "      10.8.0.1 carries the registry and woodpecker gRPC;" && \
-    note "      10.8.0.2 backs langfuse. No 51820/udp rule, nothing creates" && \
-    note "      the interface — a fresh box cannot start the gateway compose."
+# Ask the structure, not the prose: the condition is "does a peer still lack a
+# public key", not "is there a _status string". _status is ALWAYS non-empty —
+# capture rewrites it to "CAPTURED ..." — so testing it for emptiness pinned
+# this warning on permanently, including after the capture it asks for.
+uncaptured=$(estate_get "vpn.overlays.estate.peers" 2>/dev/null | python3 -c '
+import json, sys
+try:
+    peers = json.load(sys.stdin)
+except Exception:
+    sys.exit(0)
+print(" ".join(n for n, p in peers.items() if not p.get("public_key")))
+' 2>/dev/null)
+if [ -n "$uncaptured" ]; then
+    warn "overlay: public keys not captured for:$uncaptured — see 'make vpn check'"
+    note "      10.8.0.1 carries the registry and woodpecker gRPC;"
+    note "      10.8.0.2 backs langfuse. Nothing in the tree creates the"
+    note "      interface — a fresh box cannot start the gateway compose."
+    note "      capture with: sudo wg show | make vpn capture --write"
+else
+    note "overlay: $(estate_get 'vpn._status')"
+fi
 note "overlay detail: make vpn show estate"
 echo