transtation

diff --git a/install.sh b/install.sh
@@ -341,16 +341,36 @@ install_client() {
 			"$(client_image)" >/dev/null
 	fi
 
-	sleep 4
 	printf '  %-14s' self-test
-	if [ "$_tun" = 1 ]; then
-		curl -fsS --max-time 10 https://cloudflare.com/cdn-cgi/trace 2>/dev/null |
-			grep -E '^(ip|warp|colo)=' | tr '\n' ' ' || printf 'no answer yet'
+	# The result has to be captured and tested. An earlier version piped curl
+	# into grep into tr with `|| printf "no answer yet"` on the end -- which hangs
+	# off `tr`, the last command in the pipeline, and `tr` always succeeds. The
+	# fallback could never fire, so a client that was not passing any traffic at
+	# all still finished with a success banner.
+	_probe=""
+	_n=0
+	while [ "$_n" -lt 6 ]; do
+		if [ "$_tun" = 1 ]; then
+			_probe=$(curl -fsS --max-time 10 https://cloudflare.com/cdn-cgi/trace 2>/dev/null |
+				grep -E '^(ip|warp|colo)=' | tr '\n' ' ')
+		else
+			_probe=$(curl -fsS --max-time 10 --socks5-hostname 127.0.0.1:1080 https://cloudflare.com/cdn-cgi/trace 2>/dev/null |
+				grep -E '^(ip|warp|colo)=' | tr '\n' ' ')
+		fi
+		[ -n "$_probe" ] && break
+		_n=$((_n + 1))
+		sleep 2
+	done
+	if [ -n "$_probe" ]; then
+		say "$_probe"
 	else
-		curl -fsS --max-time 10 --socks5-hostname 127.0.0.1:1080 https://cloudflare.com/cdn-cgi/trace 2>/dev/null |
-			grep -E '^(ip|warp|colo)=' | tr '\n' ' ' || printf 'no answer yet -- check: docker logs transtation-client'
+		say "NO TRAFFIC"
+		say ""
+		say "  The client started but nothing is getting through. Look at:"
+		say "      docker logs transtation-client"
+		[ "$_tun" = 1 ] && say "      sudo transtation-panic     # to undo the tunnel and killswitch"
+		exit 1
 	fi
-	say ""
 
 	if [ "$_tun" = 0 ]; then
 		cat <<-'EOF'

diff --git a/server/transtation b/server/transtation
@@ -131,17 +131,29 @@ warp_ready() { warp_wanted && [ -f "$PROFILE" ]; }
 warp_register() {
 	# ONE attempt. Never a retry loop: hammering Cloudflare's registration
 	# endpoint is how a source IP -- historically a whole region -- gets blocked.
-	if wgcf register --accept-tos --config "$ACCOUNT" >/dev/null 2>&1 &&
-		wgcf generate --config "$ACCOUNT" --profile "$PROFILE" >/dev/null 2>&1; then
-		chmod 600 "$ACCOUNT" "$PROFILE"
+	#
+	# Registers into temporary files and promotes them only on success. An
+	# earlier version deleted the live profile first, so a rate-limited retry --
+	# the single most likely outcome of running this by hand -- destroyed a
+	# working WARP identity and silently degraded the server to direct egress on
+	# its next restart.
+	_ta="$DATA/.acct.$$"
+	_tp="$DATA/.prof.$$"
+	rm -f "$_ta" "$_tp"
+	if wgcf register --accept-tos --config "$_ta" >/dev/null 2>&1 &&
+		wgcf generate --config "$_ta" --profile "$_tp" >/dev/null 2>&1; then
+		chmod 600 "$_ta" "$_tp"
+		mv -f "$_ta" "$ACCOUNT"
+		mv -f "$_tp" "$PROFILE"
 		return 0
 	fi
-	rm -f "$PROFILE"
+	rm -f "$_ta" "$_tp"
 	warn "Cloudflare WARP registration failed (rate limit, or the API changed).
     Cloudflare rate-limits registration per source IP for roughly 15 minutes.
     Continuing with DIRECT egress from this VPS's own IP -- the proxy works.
       retry:            transtation warp register
-      turn off for good: set WARP=0 in your .env and 'docker compose up -d'"
+      turn off for good: set WARP=0 in your .env and 'docker compose up -d'
+    Any WARP identity you already had is untouched."
 	return 1
 }
 
@@ -1080,7 +1092,8 @@ case "${1:-run}" in
 		shift
 		case "${1:-}" in
 			register)
-				rm -f "$PROFILE"
+				# No pre-emptive delete: warp_register promotes its result only on
+				# success, so a failed retry leaves a working identity in place.
 				warp_register && { echo "WARP registered."; apply; }
 				;;
 			*) die "unknown: warp ${1:-}" ;;