fix: clarify audit side effects and boot-check scope

AppImage/messages/en/common.json

@@ -5081,7 +5081,7 @@
       "evidenceObserved": "Observed evidence",
       "evidenceExcerpt": "Compact view. The complete source evidence remains stored with this assessment.",
       "annexScope": "Complete source evidence for results that require attention, record an observation or could not be verified.",
-      "readOnlyScope": "The assessment does not change configuration. Read commands and, when needed, Lynis may generate logs or reports.",
+      "readOnlyScope": "The assessment inspects host settings and health. It can write reports and logs; boot status checks can temporarily mount EFI system partitions.",
       "capacity": "Capacity",
       "used": "Used",
       "free": "Free",
@@ -5182,7 +5182,7 @@
     "neverRun": "This host has not been assessed yet.",
     "lastRun": "Last assessed on {when}",
     "stale": "{days} days ago",
-    "readOnlyNotice": "The assessment only reads the host. It makes no changes.",
+    "readOnlyNotice": "The assessment inspects host settings and health. It can write reports and logs; boot status checks can temporarily mount EFI system partitions.",
     "unverifiedChecks": "Not taken: {checks}. Each says in its own evidence what it could not read.",
     "noFindings": "No findings match the current filter.",
     "affectedCount": "{count} affected",
@@ -5403,7 +5403,7 @@
         },
         "boot_loader": {
           "title": "Boot loader",
-          "rationale": "The EFI system partitions proxmox-boot-tool reports and the kernels each one carries. No partition is mounted and no boot is attempted.",
+          "rationale": "The EFI system partitions proxmox-boot-tool reports and the kernels each one carries. proxmox-boot-tool status can temporarily mount EFI system partitions; no boot is attempted.",
           "summary": {
             "synchronised": "The {total} boot partitions carry the same kernels",
             "attention": "{count} of {total} boot partitions need review",
@@ -5891,7 +5891,7 @@
       "scope": "Scope of this report",
       "scopeText": "This document reports the {profile} profile on the node named in the header, at the moment of the run.",
       "scopeLocal": "It covers this node only. Guests on other nodes and their configuration are outside it.",
-      "scopeReadOnly": "Every check reads configuration and state that already exists; none modifies the host.",
+      "scopeReadOnly": "The assessment inspects host settings and health. It can write reports and logs; boot status checks can temporarily mount EFI system partitions.",
       "scopeMoment": "It describes the state at the time of the run, not a period of time.",
       "notRead": "Sources that could not be read:",
       "uplink": "Uplink",

AppImage/scripts/audit_checks.py

@@ -1,8 +1,9 @@
 """Check registry and evaluation engine for Audit & Report.
 
 A check declares an identifier, an area and the severity its failure
-carries, and returns the outcome of one evaluation. Checks never modify
-the host: an assessment reads, it does not act.
+carries, and returns the outcome of one evaluation. Assessments inspect
+host settings and health. They can write reports and logs; boot status
+checks can temporarily mount EFI system partitions.
 
 Identifiers are ``<area>.<slug>`` and are frozen once published. Rewording
 a title never changes the identifier, because the accepted-risk register
@@ -185,7 +186,7 @@ class AuditContext:
         return self._cache[key]
 
     def run(self, cmd: list[str], timeout: int = 10, allowed_codes=(0,)) -> tuple[int, str]:
-        """Run a read-only command, returning exit code and output."""
+        """Run an inspection command, returning exit code and output."""
         key = "cmd:" + json.dumps(cmd)
         self.source(key)
         if key in self._cache:

AppImage/scripts/audit_checks_pve.py

@@ -2785,8 +2785,7 @@ def _update_chain(ctx):
     inherits the age of that picture.
 
     Whether each repository can still be reached is not tested: finding
-    out means refreshing the indexes, and an assessment that only reads
-    does not do that.
+    out means refreshing the indexes, which this check does not do.
     """
     # pkgcache.bin is rebuilt from files already on disk, so its date
     # says nothing about contacting a repository. These three do, in
@@ -3392,7 +3391,8 @@ def _boot_loader(ctx):
     evidence += ("\nEach partition is an EFI system partition Proxmox keeps in "
                  "step so the host survives losing any one boot disk. The "
                  "kernel each would start is read from the tool's own report; "
-                 "no partition is mounted and no boot is attempted.")
+                 "proxmox-boot-tool status can temporarily mount EFI system partitions; "
+                 "no boot is attempted.")
 
     affected = []
     for message in problems:

AppImage/scripts/flask_audit_routes.py

@@ -4,10 +4,11 @@
 ProxMenux Audit Routes
 Flask blueprint for the Audit & Report assessment engine.
 
-An assessment reads the host and records findings; it never modifies
-anything. The run endpoint is therefore the only POST that does real
-work, and it is deliberately serialised: two concurrent assessments would
-compete for the same collectors without producing a better answer.
+An assessment inspects host settings and health and records findings.
+It can write reports and logs; boot status checks can temporarily mount
+EFI system partitions. Assessment runs are deliberately serialised: two
+concurrent assessments would compete for the same collectors without
+producing a better answer.
 """
 
 import threading