v0.83.0 — the proxy probe asks about a real name

The proxy was found by asking about a name that does not exist

Detecting the pinned-TLS proxy is a TLS handshake with the name in SNI, and then a check that the certificate came from Moshpit Local CA. The proxy can only present a certificate for a name that exists — it fetches the registry pin in order to mint one. Both dns enable and dns service probed with a.<first-claimed-ending>, which is never a real name.

Measured against a proxy that was installed, trusted, and listening on 127.0.0.1:443:

a.moshpit  -> no certificate
a.2600     -> no certificate
alt.2600   -> issuer=CN=Moshpit Local CA

So a working proxy reported as absent. The unit was written without --proxy, names answered their origin, and https:// failed with a self-signed certificate. Every other layer was correct at the time — bridge healthy, routing applied, proxy running, local root trusted — and the only wrong thing in the system was the name used to ask the question.

That is the shape worth naming: the failure was in the diagnostic, not in anything it was diagnosing, so every check said the component was missing and every attempt to install it succeeded.

Naming the probe

There is no registry endpoint that lists names, so a real one cannot be discovered from here.

moshcode dns service --proxy-probe alt.2600 --write

The issuer check still runs against whatever is named. Supplying a probe says which name to ask about; it never asserts that a proxy is there, and a machine with nothing on 443 still detects nothing. A bare --proxy-probe is reported as the typo it is, rather than falling back to the synthetic name that cannot work.

Without the flag the old synthetic name is still used. It is correct on a machine whose proxy serves every ending, and dropping it would turn "detected nothing" into "refused to look".

A message that was hiding two different problems

"No pinned-TLS proxy found on this machine" was true for two causes with completely different remedies: the proxy is not installed, or it is installed and listening and was asked about a name it cannot serve. The output now separates them, and says what each one means for https://.