diff --git a/Tools/audit_headers.sh b/Tools/audit_headers.sh
index 05f70d7..66839a0 100755
--- a/Tools/audit_headers.sh
+++ b/Tools/audit_headers.sh
@@ -83,7 +83,8 @@ done
 # and handled as soft checks — see OPERATIONAL MODEL.
 spec_for() {
     case "$1" in
-        sh|tools) echo "PURPOSE|OPERATIONAL MODEL|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|RUNTIME MODES" ;;
+        sh)       echo "PURPOSE|OPERATIONAL MODEL|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|RUNTIME MODES" ;;
+        tools)    echo "PURPOSE|OPERATIONAL MODEL|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|RUNTIME MODES/ARGUMENTS" ;;
         api)      echo "PURPOSE|OPERATIONAL MODEL|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|REQUEST|RESPONSE|DEPENDS ON" ;;
         include)  echo "PURPOSE|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|EXPORTS" ;;
         pages)    echo "PURPOSE|DESIGN PRINCIPLES|OPERATIONAL SAFEGUARDS|RENDERS|DEPENDS ON" ;;
@@ -91,6 +92,13 @@ spec_for() {
 }
 
 role_for() {
+    # A PHP file that refuses to run outside the CLI is a script, wherever it is filed.
+    # api/docker_pull_worker.php lives beside the endpoints because docker_action.php spawns it,
+    # but it takes argv and never a request — judging it on REQUEST and RESPONSE would mean
+    # inventing a contract it does not have.
+    if [[ "$1" == *.php ]] && grep -q "PHP_SAPI !== 'cli'" "$1" 2>/dev/null; then
+        echo "tools"; return
+    fi
     case "$1" in
         *.sh)                     echo "sh" ;;
         */Plugin/*/Tools/*.php)   echo "tools" ;;
@@ -130,12 +138,21 @@ while IFS= read -r f; do
     present=()
     missing=()
     for s in "${want[@]}"; do
-        n=$(grep -c "^$m $s\$" "$f")
-        case "$n" in
-            0) missing+=("$s") ;;
-            1) present+=("$s") ;;
-            *) present+=("$s"); problems+=("duplicate section: $s appears $n times") ;;
-        esac
+        # A spec entry may name alternatives with "/". RUNTIME MODES/ARGUMENTS is the only one:
+        # a worker that is spawned rather than run has no modes an operator can choose, and both
+        # spawned workers in the tree document ARGUMENTS instead. Demanding RUNTIME MODES there
+        # would mean writing an invocation nobody performs.
+        found=""
+        IFS='/' read -ra alts <<< "$s"
+        for a in "${alts[@]}"; do
+            n=$(grep -c "^$m $a\$" "$f")
+            if [[ "$n" -gt 1 ]]; then
+                present+=("$a"); problems+=("duplicate section: $a appears $n times"); found="$a"; break
+            elif [[ "$n" -eq 1 ]]; then
+                present+=("$a"); found="$a"; break
+            fi
+        done
+        [[ -z "$found" ]] && missing+=("${s//\// or }")
     done
     if [[ ${#missing[@]} -gt 0 ]]; then
         problems+=("missing: $(IFS=', '; echo "${missing[*]}")")