A wrong active-client pointer has no supported recovery — and doctor then says "no secure environment" over a healthy install

[LukasWodka]

Summary

When the active-client pointer names a client that isn't on the cluster the kubeconfig reaches, the CLI reports it and offers two remedies — neither of which repoints the machine. There is no supported way back, and doctor and the home screen then tell the user to reinstall over a healthy install.

Field symptom:

Error: active client "X" runs on another machine — namespace "x" isn't on the cluster
your kubeconfig points at; run this command there, or override with --namespace/--context

on a laptop with a healthy local k3d cluster.

1. The message is the RFC's sentence with the remedy deleted

RFC-0001 §7.3 specified three:

"client X runs on another machine — run data commands there, or tracebloc client use a local one."

The shipped string (internal/cli/clustertarget.go:229-232) is that sentence minus the third clause, removed when Rev 9 withdrew client use (client.go:40-42: "nothing to select: client use is withdrawn, and client list is hidden"). The remedy was removed; nothing replaced it. This one string is shared by seven commands (cluster.go:165, data_list.go:127, data_delete.go:178, data_ingest_cluster.go:61, resources.go:95, resources_set.go:148, seal.go:81).

--namespace is named but unusable as written: it only helps if the user already knows the local namespace, and nothing in the CLI will tell them.

2. Recovery paths exist; none is discoverable

• tracebloc client create — the intended repoint. On a cluster that already hosts the user's client it adopts and repoints with no prompt and no new credential. But create is Hidden: true (client.go:73), so tracebloc client --help lists only status. Pointing a user at a hidden command is a dead end. And on a cluster with no client it falls to the mint path and creates the phantom that Hidden exists to prevent (backend#970) — TTY-prompted, pipe-refused, but still the wrong default advice.
• logout && login clears the whole profile (auth.go), which empties the pointer and lets the fallback scan find the local client. Works; absurdly indirect; undocumented.
• Hand-editing active_client_namespace out of ~/.tracebloc/config.json. Undocumented.

tracebloc delete is a trap, not a reset. It clears the pointer — but first revokes the remote client's machine credential and attempts helm uninstall on its namespace (delete.go:113-140). A user reaching for it to "reset my CLI" breaks someone else's machine.

3. doctor and the home screen make it worse

doctor.go:159 binds the same pointer and probes only that namespace — it never calls discoverRelease, so there is no scan. It reports "No secure environment on this machine yet" and points at the installer, over a working install (doctor.go:184-190).

The home screen has the same hole: its local-env fallback is reached only if !binding.applied, so a non-empty-but-wrong pointer skips the #401 fix entirely. #401 fixed the empty-pointer case; the wrong-pointer case was never covered and nothing is filed for it.

4. Two specified mitigations were never implemented

RFC-0001 §7.5 (:648-660) specified both: "login to a different account drops it if the client isn't in the new account" and "cheap re-validation on each client/data command: if the active client isn't in the signed-in account, drop it." Neither exists. Either would have prevented this state.

Proposed fix — diagnose before advising, change no targeting behaviour

allowScan() must stay false: a binding miss must never silently retarget (§7.5). But that governs targeting, not information — and the same file already prints other namespaces in an error when it finds several (clustertarget.go:150-155), and already spends a cluster-wide list purely to produce a better message (:137-149).

Thread the clientset + server URL into explain (clustertarget.go:217) — all seven call sites already hold both — and on a binding-applied noParentReleaseError run the existing cluster.FindClientNamespaces for naming only, branching on the existing isLocalServerURL predicate (home_local_fallback.go:71, the #401 carve-out for loopback / host.docker.internal / k3d):

• one client found + local server URL → name it and offer the repoint
• client(s) on a remote/shared cluster → name the namespaces, offer only --namespace; never suggest client create here — that is the §7.5 boundary and it stays intact
• none found → today's text plus "no tracebloc client is running on this cluster either", which correctly points at the installer

Target wording:

Error: active client "X" runs on another machine — namespace "x" isn't on the cluster
your kubeconfig points at.

A tracebloc client IS running on this machine, in namespace "lukas-02".
  Point this machine at it:  tracebloc client create
      (this cluster already runs a client, so it adopts it — no new credential)
  Or target it just this once:  --namespace lukas-02

Also required for the fix to reach anyone

• Unhide client create (or give the repoint a visible alias). Advice pointing at a hidden command is not advice.
• Extend home: healthy installed environment shows "No secure environment on this machine yet" when the active-client pointer is missing (doctor disagrees) #401's local fallback to binding.applied misses in doctor.go and home.go, so the two commands a stuck user reaches for next stop telling them to reinstall a working environment.
• Have client list mark which client matches the local cluster, not just which is active — today it prints (active — this machine) next to a client that is provably not on this machine.

Context

The upstream cause of these wrong pointers is tracked separately: orphaned client records left behind by cluster recreation.

[LukasWodka]

/fr-pass

Best-effort FR passed (triage; behavioral evidence limited while e2e journey red — backend#2206). Advancing to Ready for prod.