ohs doctor prints one ok or fail line per check and exits non-zero on any failure: configuration, database, raw store, public URL, the required keys of every enabled connector, and the keys that seal the stored secrets. For each enabled OAuth connector it prints the callback URL to register with the provider: <OHS_PUBLIC_URL>/oauth/<slug>/callback. A connector that needs keys and has none set gets a skip line, skip connector withings: disabled (no keys); one with only some of its keys is a fail. The stored OAuth tokens and webhook secrets are counted by the key that seals them: a warn line (which does not fail the run) names how many still use a previous key or open with no configured key, and says when OHS_PREVIOUS_ENCRYPTION_KEYS is no longer needed (see rotating the encryption key). --quick checks the database and raw store only. The full run also writes and deletes a probe object in the raw store; a host folder bind mounted at /var/lib/ohs/raw must be writable by the container user (chown -R 65532:65532 <folder>). ohs serve runs the same write check at start and stops if it fails.