@vantageos/mcp-doctor 0.8.1 → 0.8.3

package/dist/doctor.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/doctor.ts
-import { readFileSync as readFileSync17, realpathSync } from "fs";
+import { readFileSync as readFileSync16, realpathSync } from "fs";
 import { dirname as dirname17, join as join27, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -508,7 +508,7 @@ function countInCode(file, line, ch) {
 }
 
 // src/detectors/couldNotJudge.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 function couldNotJudge(id, anchor, reason, owedVerdict) {
   return {
     id,
@@ -519,6 +519,12 @@ function couldNotJudge(id, anchor, reason, owedVerdict) {
     ...owedVerdict ? { owedVerdict } : {}
   };
 }
+function refusedAsUnreadable(refused, what) {
+  return refused.map((r) => ({
+    anchor: r.rel,
+    reason: `${r.rel} ${r.reason}: ${what}`
+  }));
+}
 function settle(id, decided, unreadable) {
   if (unreadable.length === 0) return decided;
   const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
@@ -536,6 +542,7 @@ function settle(id, decided, unreadable) {
 function readJsonObject(path) {
   let value;
   try {
+    if (!statSync2(path).isFile()) return null;
     value = JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     return null;
@@ -563,7 +570,7 @@ function guardUnreadablePackageJson(inner, opts) {
 }
 
 // src/detectors/siteScan.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { constants as constants2, accessSync as accessSync2, existsSync as existsSync2, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { join as join2, relative as relative2, sep as sep2 } from "path";
 function codeSites(tree, re) {
   const out = [];
@@ -630,27 +637,33 @@ function isRecord(v) {
 }
 function baseOf(tree) {
   try {
-    return statSync2(tree.root).isDirectory() ? tree.root : join2(tree.root, "..");
+    return statSync3(tree.root).isDirectory() ? tree.root : join2(tree.root, "..");
   } catch {
     return tree.root;
   }
 }
 function findDiskFiles(tree, pred) {
   const out = [];
+  const refused = [];
   const base = baseOf(tree);
   const walk2 = (dir) => {
     let entries;
     try {
       entries = readdirSync2(dir);
-    } catch {
+    } catch (err) {
+      recordSkip(tree, dir, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
       return;
     }
     for (const name of entries.sort()) {
       const full = join2(dir, name);
       let st;
       try {
-        st = statSync2(full);
-      } catch {
+        st = statSync3(full);
+      } catch (err) {
+        const why = `could not be read (${fsErrorCode(err)}) \u2014 not read`;
+        recordSkip(tree, full, base, why);
+        const relBad = relative2(base, full).split(sep2).join("/");
+        if (pred(name, relBad)) refused.push({ rel: relBad, reason: why });
         continue;
       }
       if (st.isDirectory()) {
@@ -661,15 +674,31 @@ function findDiskFiles(tree, pred) {
         walk2(full);
       } else {
         const rel = relative2(base, full).split(sep2).join("/");
-        if (pred(name, rel)) out.push({ path: full, rel, name });
+        if (!pred(name, rel)) continue;
+        if (!st.isFile()) {
+          const why = "not a regular file (FIFO, socket or device) \u2014 not read";
+          recordSkip(tree, full, base, why);
+          refused.push({ rel, reason: why });
+          continue;
+        }
+        try {
+          accessSync2(full, constants2.R_OK);
+        } catch (err) {
+          const why = `could not be read (${fsErrorCode(err)}) \u2014 not read`;
+          recordSkip(tree, full, base, why);
+          refused.push({ rel, reason: why });
+          continue;
+        }
+        out.push({ path: full, rel, name });
       }
     }
   };
   walk2(base);
-  return out;
+  return Object.assign(out, { refused });
 }
 function readText(path) {
   try {
+    if (!statSync3(path).isFile()) return null;
     return readFileSync3(path, "utf8");
   } catch {
     return null;
@@ -1695,12 +1724,29 @@ var a2DeclaredDomains = {
       }
     }
     const configs = findDiskFiles(tree, (n) => /^vite\.config\.(ts|js|mjs|cjs|mts)$/.test(n));
-    if (configs.length === 0) {
+    let configUnread = false;
+    for (const r of configs.refused) {
+      configUnread = true;
+      unreadable.push({
+        anchor: r.rel,
+        reason: `${r.rel} ${r.reason}: how the UI bundle is built (single file or not) is unread`
+      });
+    }
+    const texts2 = configs.map((c) => ({ rel: c.rel, text: readText(c.path) }));
+    for (const t of texts2) {
+      if (t.text !== null) continue;
+      configUnread = true;
+      unreadable.push({
+        anchor: t.rel,
+        reason: `${t.rel} could not be read \u2014 how the UI bundle is built (single file or not) is unread`
+      });
+    }
+    if (configs.length === 0 && configs.refused.length === 0) {
       unreadable.push({
         anchor: ui[0].anchor,
         reason: "no vite.config.* in the tree \u2014 how the UI bundle is built (single file or not) is unread"
       });
-    } else if (!configs.some((c) => SINGLEFILE_RE.test(stripComments(readText(c.path) ?? "")))) {
+    } else if (!configUnread && !texts2.some((t) => SINGLEFILE_RE.test(stripComments(t.text ?? "")))) {
       reds.push({
         anchor: configs[0].rel,
         text: `${configs[0].rel} builds the UI without a single-file plugin (vite-plugin-singlefile or an inlining equivalent): the bundle is multi-file`
@@ -1738,7 +1784,7 @@ var a2DeclaredDomains = {
 };
 
 // src/detectors/v080Kit.ts
-import { existsSync as existsSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
 import { dirname as dirname2, join as join3 } from "path";
 
 // src/detectors/toolContext.ts
@@ -2617,11 +2663,14 @@ function productSites(tree, re) {
 }
 function diskText(tree, pred) {
   const out = [];
-  for (const f of findDiskFiles(tree, pred)) {
+  const found = findDiskFiles(tree, pred);
+  const refused = [...found.refused];
+  for (const f of found) {
     const text = readText(f.path);
     if (text !== null) out.push({ ...f, text });
+    else refused.push({ rel: f.rel, reason: "could not be read \u2014 not read" });
   }
-  return out;
+  return Object.assign(out, { refused });
 }
 function governingWorkflows(tree) {
   let dir = baseOf(tree);
@@ -2629,16 +2678,29 @@ function governingWorkflows(tree) {
     const wf = join3(dir, ".github", "workflows");
     if (existsSync3(wf)) {
       const out = [];
-      for (const name of readdirSync3(wf).sort()) {
+      const base = baseOf(tree);
+      let names;
+      try {
+        names = readdirSync3(wf).sort();
+      } catch (err) {
+        recordSkip(tree, wf, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
+        return out;
+      }
+      for (const name of names) {
         if (!/\.ya?ml$/.test(name)) continue;
         const full = join3(wf, name);
         try {
-          if (!statSync3(full).isFile()) continue;
-        } catch {
+          if (!statSync4(full).isFile()) {
+            recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+            continue;
+          }
+        } catch (err) {
+          recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
           continue;
         }
         const text = readText(full);
         if (text !== null) out.push({ rel: `.github/workflows/${name}`, text });
+        else recordSkip(tree, full, base, "could not be read \u2014 not read");
       }
       return out;
     }
@@ -2727,6 +2789,12 @@ function appSurface(tree) {
   const anchor = uiSites[0]?.anchor ?? (uiFiles[0] ? `${uiFiles[0].rel}:1` : `${html[0].rel}:1`);
   return { anchor, uiFiles };
 }
+function unreadHtmlShells(tree) {
+  return refusedAsUnreadable(
+    findDiskFiles(tree, (name) => /\.html?$/i.test(name)).refused,
+    "whether the tree is an App (UI code held in an HTML shell) is unread"
+  );
+}
 function codeOnly(text) {
   return text.replace(/(["'`])((?:\\.|(?!\1)[^\\\n])*)\1(?!\s*:)/g, (_m, q) => `${q}${q}`);
 }
@@ -2786,10 +2854,14 @@ var a3SandboxRespected = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "no UI code, no HTML and no ui:// resource in the tree (positive control OK) \u2014 A-3 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "no UI code, no HTML and no ui:// resource in the tree (positive control OK) \u2014 A-3 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
     const uiRels = new Set(app.uiFiles.map((f) => f.rel));
@@ -2803,7 +2875,11 @@ var a3SandboxRespected = {
         inlineScripts.push({ anchor: `${file.rel}:${line}`, body: m[1] });
       }
     }
-    if (uiRels.size === 0 && htmlShells.length === 0 && inlineScripts.length === 0) {
+    const unreadShells = refusedAsUnreadable(
+      htmlShells.refused,
+      "its <script> blocks (parent-frame access, direct storage) are unread"
+    );
+    if (uiRels.size === 0 && htmlShells.length === 0 && inlineScripts.length === 0 && unreadShells.length === 0) {
       return couldNotJudge(
         this.id,
         app.anchor,
@@ -2839,17 +2915,25 @@ var a3SandboxRespected = {
         }
       }
     }
+    const unreadHtml = refusedAsUnreadable(
+      htmlFiles.refused,
+      "its <script> blocks (parent-frame access, direct storage) are unread"
+    );
     if (reds.length > 0) {
-      return redResult(
+      return settle(
         this.id,
-        reds[0].split(" ")[0],
-        `${reds.join("; ")} (A-3, positive-control OK)`
+        redResult(this.id, reds[0].split(" ")[0], `${reds.join("; ")} (A-3, positive-control OK)`),
+        unreadHtml
       );
     }
-    return presentResult(
+    return settle(
       this.id,
-      app.anchor,
-      `${uiRels.size} UI file(s), ${htmlFiles.length} HTML shell(s) and ${inlineScripts.length} inline script(s) in strings: no parent-frame access, no direct storage \u2014 everything is left to the bridge (positive-control OK); the double-iframe CSP is the host proxy's (A-3)`
+      presentResult(
+        this.id,
+        app.anchor,
+        `${uiRels.size} UI file(s), ${htmlFiles.length} HTML shell(s) and ${inlineScripts.length} inline script(s) in strings: no parent-frame access, no direct storage \u2014 everything is left to the bridge (positive-control OK); the double-iframe CSP is the host proxy's (A-3)`
+      ),
+      unreadHtml
     );
   }
 };
@@ -2875,13 +2959,18 @@ var a4WcagGate = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-4 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-4 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
-    const noUiCode = app.uiFiles.length === 0 && findDiskFiles(tree, (name) => /\.html?$/i.test(name)).length === 0;
+    const htmlShells = findDiskFiles(tree, (name) => /\.html?$/i.test(name));
+    const noUiCode = app.uiFiles.length === 0 && htmlShells.length === 0;
     const pkgs = diskText(tree, (name) => name === "package.json");
     const unreadable = [];
     let dep = null;
@@ -2906,11 +2995,17 @@ var a4WcagGate = {
     const workflowRun = governingWorkflows(tree).find(
       (w) => /\baxe\b|axe-core/i.test(stripYamlComments(w.text))
     );
-    const testRun = diskText(tree, (name) => /\.(?:test|spec)\.[jt]sx?$/.test(name)).find(
+    const testFiles = diskText(tree, (name) => /\.(?:test|spec)\.[jt]sx?$/.test(name));
+    const testRun = testFiles.find(
       (f) => /\baxe\b|axe-core|jest-axe|vitest-axe/i.test(stripJsComments(f.text))
     );
+    const refusedInputs = [
+      ...refusedAsUnreadable(pkgs.refused, "its axe dependency and scripts are unread"),
+      ...refusedAsUnreadable(testFiles.refused, "a test file that may run axe is unread"),
+      ...refusedAsUnreadable(htmlShells.refused, "an HTML shell of the App is unread")
+    ];
     const run = scriptRun ?? (workflowRun ? workflowRun.rel : null) ?? (testRun ? testRun.rel : null);
-    if (noUiCode && dep === null && run === null && unreadable.length === 0) {
+    if (noUiCode && dep === null && run === null && unreadable.length === 0 && refusedInputs.length === 0) {
       return couldNotJudge(
         this.id,
         app.anchor,
@@ -2924,6 +3019,13 @@ var a4WcagGate = {
         `${unreadable.join(", ")} is present but could not be parsed (not valid JSON): the axe dependency and the scripts it lists are unreadable, so neither "no gate" nor "a gate" can be said${run === null ? "" : ` (a run was found at ${run})`}; owed: a parsable manifest, then an axe gate that CI runs with 0 blocking WCAG AA violations (A-4)`
       );
     }
+    if (run === null && refusedInputs.length > 0) {
+      return couldNotJudge(
+        this.id,
+        `${refusedInputs[0].anchor}:1`,
+        `${refusedInputs.map((u) => u.reason).join("; ")}: neither "no gate" nor "an axe dependency that nothing runs" can be said over an input that was not read${dep === null ? "" : ` (${dep} is declared)`}; owed: a readable input, then an axe gate that CI runs with 0 blocking WCAG AA violations (A-4)`
+      );
+    }
     if (dep === null && run === null) {
       return redResult(
         this.id,
@@ -2947,7 +3049,7 @@ var a4WcagGate = {
 };
 
 // src/detectors/a5-performance-budgets.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync4, readdirSync as readdirSync4, statSync as statSync5 } from "fs";
 import { join as join4, relative as relative3, sep as sep3 } from "path";
 import { gzipSync } from "zlib";
 var BUDGET_BYTES = 250 * 1024;
@@ -2983,7 +3085,7 @@ function collect(base) {
       const candidate = BUNDLE_EXT_RE.test(name) && UI_PATH_RE.test(rel);
       let st;
       try {
-        st = statSync4(full);
+        st = statSync5(full);
       } catch {
         if (candidate) unmeasured.push(`${rel} (cannot be read: dangling link or permission)`);
         continue;
@@ -2991,6 +3093,10 @@ function collect(base) {
       if (st.isDirectory()) {
         if (!WALK_SKIP.has(name)) walk2(full, depth + 1);
       } else if (candidate) {
+        if (!st.isFile()) {
+          unmeasured.push(`${rel} (not a regular file, not read)`);
+          continue;
+        }
         if (st.size > MAX_MEASURE_BYTES) {
           unmeasured.push(`${rel} (${(st.size / 1048576).toFixed(0)} MB, too large to measure)`);
           continue;
@@ -3020,10 +3126,14 @@ var a5PerformanceBudgets = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-5 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-5 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
     const { bundles, unmeasured } = collect(baseOf(tree));
@@ -3212,7 +3322,14 @@ function codeBlockAfter(file, line, col, open, close) {
 function scanCapabilities(tree) {
   const caps = [];
   const unreadable = [];
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  const manifests = findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json");
+  for (const r of manifests.refused) {
+    unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: its declared capabilities are unread`
+    });
+  }
+  for (const f of manifests) {
     const json = readJsonRecord(f.path);
     if (!json) {
       unreadable.push({
@@ -3413,7 +3530,14 @@ function collectNamespacedKeys(tree) {
   for (const site of codeSites(tree, META_BRACKET_RE)) {
     acc.keys.push({ key: site.match[2], anchor: site.anchor, context: "_meta", source: "code" });
   }
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  const manifests = findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json");
+  for (const r of manifests.refused) {
+    acc.unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: its capability keys are unread`
+    });
+  }
+  for (const f of manifests) {
     const json = readJsonRecord(f.path);
     if (!json) {
       acc.unreadable.push({
@@ -3546,17 +3670,25 @@ function assertSkillsControl(id) {
   }
 }
 function readSkillFiles(tree) {
-  return findDiskFiles(tree, (n) => n === "SKILL.md").map((f) => {
-    const text = readText(f.path) ?? "";
+  const found = findDiskFiles(tree, (n) => n === "SKILL.md");
+  const files = [];
+  const refused = [...found.refused];
+  for (const f of found) {
+    const text = readText(f.path);
+    if (text === null) {
+      refused.push({ rel: f.rel, reason: "could not be read \u2014 not read" });
+      continue;
+    }
     const parts = f.rel.split("/");
-    return {
+    files.push({
       path: f.path,
       rel: f.rel,
       dir: parts[parts.length - 2] ?? "",
       name: frontmatterName(text),
       text
-    };
-  });
+    });
+  }
+  return Object.assign(files, { refused });
 }
 
 // src/detectors/a8-ui-skills-disjoint.ts
@@ -3603,7 +3735,12 @@ var a8UiSkillsDisjoint = {
         });
       }
     }
-    for (const sf of readSkillFiles(tree)) {
+    const skillFiles = readSkillFiles(tree);
+    const unreadSkills = refusedAsUnreadable(
+      skillFiles.refused,
+      "its frontmatter (a ui:// reference) is unread"
+    );
+    for (const sf of skillFiles) {
       const fm = sf.text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       const hit = fm?.[1].match(/ui:\/\/\S+/);
       if (hit)
@@ -3613,17 +3750,25 @@ var a8UiSkillsDisjoint = {
         });
     }
     if (reds.length > 0) {
-      return {
-        id: this.id,
-        anchor: reds[0].anchor,
-        state: "non-conforming",
-        verdict: `${reds.map((r) => r.text).join("; ")} -> skills are plain markdown under the Skills extension, UI resources live under ui://, the two sets never overlap (A-8)`
-      };
+      return settle(
+        this.id,
+        {
+          id: this.id,
+          anchor: reds[0].anchor,
+          state: "non-conforming",
+          verdict: `${reds.map((r) => r.text).join("; ")} -> skills are plain markdown under the Skills extension, UI resources live under ui://, the two sets never overlap (A-8)`
+        },
+        unreadSkills
+      );
     }
-    return couldNotJudge(
+    return settle(
       this.id,
-      surface.anchor,
-      "no source literal mixes the two spaces; owed (dynamic): skills/list and the ui:// resource list, compared \u2014 no manifest uri uses the UI scheme or equals a listed UI resource, no skills/list entry starts with ui:// (A-8)"
+      couldNotJudge(
+        this.id,
+        surface.anchor,
+        "no source literal mixes the two spaces; owed (dynamic): skills/list and the ui:// resource list, compared \u2014 no manifest uri uses the UI scheme or equals a listed UI resource, no skills/list entry starts with ui:// (A-8)"
+      ),
+      unreadSkills
     );
   }
 };
@@ -4244,7 +4389,7 @@ var a12FileWrite = {
 };
 
 // src/detectors/c7-artifact-verifiable.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync6 } from "fs";
 import { join as join5 } from "path";
 var PIN = STANDARD_PIN;
 var DOC_FILES = ["README.md", "README.fr.md"];
@@ -4282,13 +4427,18 @@ function c7PositiveControls() {
     }
   };
 }
-function readDocText(root) {
+function readDocText(root, unreadable) {
   for (const name of DOC_FILES) {
     const path = join5(root, name);
     if (!existsSync4(path)) continue;
     try {
+      if (!statSync6(path).isFile()) {
+        unreadable.push({ anchor: name, reason: `${name} is not a regular file \u2014 not read` });
+        continue;
+      }
       return { text: readFileSync5(path, "utf8"), file: name };
-    } catch {
+    } catch (err) {
+      unreadable.push({ anchor: name, reason: `${name} could not be read (${fsErrorCode(err)})` });
     }
   }
   return null;
@@ -4319,7 +4469,15 @@ var c7ArtifactVerifiable = {
         `C7 channel-matcher control FAILED on \`${controls.channelMatcher.sample}\` \u2014 matcher broken, verdict untrustworthy`
       );
     }
-    const doc = readDocText(tree.root);
+    const unreadable = [];
+    const doc = readDocText(tree.root, unreadable);
+    if (unreadable.length > 0) {
+      return couldNotJudge(
+        this.id,
+        unreadable[0].anchor,
+        `${unreadable.map((u) => u.reason).join("; ")} \u2014 the install, pin, channel and provenance propositions are unjudged (C-7)`
+      );
+    }
     if (!doc) {
       return {
         id: this.id,
@@ -4991,7 +5149,14 @@ function sameFileConstObject(file, name) {
 }
 function ceilingCensus(tree) {
   const census = { readable: [], partial: [], unreadable: [] };
-  for (const f of findDiskFiles(tree, (n) => SERVER_MANIFEST_NAMES.has(n))) {
+  const manifests = findDiskFiles(tree, (n) => SERVER_MANIFEST_NAMES.has(n));
+  for (const r of manifests.refused) {
+    census.unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: a contextCeiling it may declare is unread`
+    });
+  }
+  for (const f of manifests) {
     const text = readText(f.path);
     if (text === null) {
       census.unreadable.push({ anchor: f.rel, reason: `${f.rel} is not readable as text` });
@@ -5582,7 +5747,7 @@ var c16UntrustedOutput = {
 };
 
 // src/detectors/c17-supply-chain.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync5, statSync as statSync7 } from "fs";
 import { dirname as dirname3, join as join6, relative as relative4, resolve } from "path";
 var PIN4 = STANDARD_PIN;
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
@@ -5616,15 +5781,26 @@ function judgeProvenanceRecord(line, name, version) {
   }
   return { ok: true, why: "" };
 }
-function findProvenanceRecord(root, name, version) {
+function findProvenanceRecord(root, name, version, unreadable) {
   let firstBad = null;
   for (const recordFile of PROVENANCE_RECORD_FILES) {
     const path = join6(root, recordFile);
     if (!existsSync5(path)) continue;
     let text;
     try {
+      if (!statSync7(path).isFile()) {
+        unreadable.push({
+          anchor: recordFile,
+          reason: `${recordFile} is not a regular file \u2014 not read`
+        });
+        continue;
+      }
       text = readFileSync6(path, "utf8");
-    } catch {
+    } catch (err) {
+      unreadable.push({
+        anchor: recordFile,
+        reason: `${recordFile} could not be read (${fsErrorCode(err)})`
+      });
       continue;
     }
     const lines = text.split("\n");
@@ -5677,7 +5853,7 @@ function findLockfile(root) {
   }
   return null;
 }
-function findProvenanceClaim(tree, root) {
+function findProvenanceClaim(tree, root, unreadable) {
   const pkg = tree.packageJson;
   if (pkg) {
     const publishConfig = pkg.json.publishConfig;
@@ -5691,16 +5867,29 @@ function findProvenanceClaim(tree, root) {
     let entries = [];
     try {
       entries = readdirSync5(workflowsDir).sort();
-    } catch {
+    } catch (err) {
+      unreadable.push({
+        anchor: relative4(root, workflowsDir) || WORKFLOW_DIR,
+        reason: `${relative4(root, workflowsDir) || WORKFLOW_DIR} cannot be listed (${fsErrorCode(err)})`
+      });
       continue;
     }
     for (const name of entries) {
       if (!/\.ya?ml$/.test(name)) continue;
       const path = join6(workflowsDir, name);
       let text;
+      const shown = `${relative4(root, workflowsDir) || WORKFLOW_DIR}/${name}`;
       try {
+        if (!statSync7(path).isFile()) {
+          unreadable.push({ anchor: shown, reason: `${shown} is not a regular file \u2014 not read` });
+          continue;
+        }
         text = readFileSync6(path, "utf8");
-      } catch {
+      } catch (err) {
+        unreadable.push({
+          anchor: shown,
+          reason: `${shown} could not be read (${fsErrorCode(err)})`
+        });
         continue;
       }
       const hit = workflowStatements(text).find(([, l]) => PROVENANCE_RE2.test(l));
@@ -5749,10 +5938,11 @@ var c17SupplyChainInner = {
         verdict: "no committed lockfile (package-lock.json/pnpm-lock.yaml/yarn.lock/bun.lock) found -> dependencies are not pinned; commit a lockfile (C-17a)"
       };
     }
-    const claim = findProvenanceClaim(tree, tree.root);
+    const unreadable = [];
+    const claim = findProvenanceClaim(tree, tree.root, unreadable);
     const pkgVersion = typeof tree.packageJson?.json.version === "string" ? tree.packageJson.json.version : void 0;
     const pkgName = typeof tree.packageJson?.json.name === "string" ? tree.packageJson.json.name : void 0;
-    const record = claim ? null : findProvenanceRecord(tree.root, pkgName, pkgVersion);
+    const record = claim ? null : findProvenanceRecord(tree.root, pkgName, pkgVersion, unreadable);
     if (!claim && record?.ok) {
       return {
         id: this.id,
@@ -5769,6 +5959,13 @@ var c17SupplyChainInner = {
         verdict: `lockfile ${lockfile} present and a \`Provenance:\` line at ${record.site}, but ${record.why} -> a record covers only the version it names and must carry the reproduced 40-hex shasum (C-17, non-CI path; proposed evidence form)`
       };
     }
+    if (!claim && !record && unreadable.length > 0) {
+      return couldNotJudge(
+        this.id,
+        unreadable[0].anchor,
+        `no provenance claim in the readable places, but ${unreadable.length} candidate(s) were present and unread \u2014 ${unreadable.map((u) => u.reason).join("; ")} (C-17b)`
+      );
+    }
     if (!claim) {
       return {
         id: this.id,
@@ -5790,7 +5987,7 @@ var c17SupplyChain = guardUnreadablePackageJson(c17SupplyChainInner, {
 });
 
 // src/detectors/c18-structure-manifest.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7, statSync as statSync8 } from "fs";
 import { join as join7 } from "path";
 var PIN5 = STANDARD_PIN;
 function manifestPath(root) {
@@ -5815,16 +6012,31 @@ function rootCandidates(root) {
   for (const name of SERVER_MANIFEST_NAMES2) {
     const path = join7(root, name);
     if (!existsSync6(path)) continue;
-    const json = readJson(path);
-    out.push({ name, path, role: classifyRootJson(json), json });
+    const { json, readError } = readJson(path);
+    out.push({
+      name,
+      path,
+      role: classifyRootJson(json),
+      json,
+      ...readError ? { readError } : {}
+    });
   }
   return out;
 }
 function readJson(path) {
+  let text;
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    if (!statSync8(path).isFile()) {
+      return { json: null, readError: "not a regular file \u2014 not read" };
+    }
+    text = readFileSync7(path, "utf8");
+  } catch (err) {
+    return { json: null, readError: `could not be read (${fsErrorCode(err)})` };
+  }
+  try {
+    return { json: JSON.parse(text) };
   } catch {
-    return null;
+    return { json: null };
   }
 }
 function c18PositiveControls() {
@@ -5883,6 +6095,14 @@ var c18StructureManifestInner = {
     let manifestName = kind === "extension" ? "extension.json" : "mcp.json";
     if (kind === "server") {
       const cands = rootCandidates(tree.root);
+      const unread = cands.find((c) => c.readError !== void 0);
+      if (unread) {
+        return couldNotJudge(
+          this.id,
+          unread.path,
+          `${unread.name} is present but ${unread.readError} \u2014 the server manifest cannot be judged (C-18)`
+        );
+      }
       const bad = cands.find((c) => c.role === "unparseable");
       if (bad) {
         return {
@@ -5923,7 +6143,15 @@ var c18StructureManifestInner = {
           verdict: "no extension.json found at the tree root -> the extension manifest is required (C-18)"
         };
       }
-      manifest = readJson(path);
+      const read = readJson(path);
+      if (read.readError !== void 0) {
+        return couldNotJudge(
+          this.id,
+          path,
+          `${manifestName} is present but ${read.readError} \u2014 the manifest cannot be judged (C-18)`
+        );
+      }
+      manifest = read.json;
       if (!manifest) {
         return {
           id: this.id,
@@ -6368,7 +6596,7 @@ var c21ProgressiveDisclosure = {
 };
 
 // src/detectors/c22-test-ratio-gate.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, statSync as statSync9 } from "fs";
 import { join as join8 } from "path";
 var DOC_FILES2 = ["README.md", "README.fr.md", "CHANGELOG.md"];
 var RATIO_RE = /\b(?:coverage|ratio de tests?|test ratio|couverture)\b[^\n%]{0,40}?(\d{1,3}(?:\.\d+)?\s?%)/i;
@@ -6391,15 +6619,20 @@ function c22PositiveControls() {
     identifierClearsBareRatio: !IDENTIFIER_RE.test(bareSample)
   };
 }
-function findRatioCitations(root) {
+function findRatioCitations(root, unreadable) {
   const hits = [];
   for (const name of DOC_FILES2) {
     const path = join8(root, name);
     if (!existsSync7(path)) continue;
     let text;
     try {
+      if (!statSync9(path).isFile()) {
+        unreadable.push({ anchor: name, reason: `${name} is not a regular file \u2014 not read` });
+        continue;
+      }
       text = readFileSync8(path, "utf8");
-    } catch {
+    } catch (err) {
+      unreadable.push({ anchor: name, reason: `${name} could not be read (${fsErrorCode(err)})` });
       continue;
     }
     const lines = text.split("\n");
@@ -6417,44 +6650,48 @@ var c22TestRatioGate = {
   rule: "C-22",
   pin: STANDARD_PIN,
   run(tree) {
-    const controls = c22PositiveControls();
-    if (!controls.ratioMatcher.matched || !controls.identifierMatcher.matched) {
-      throw new Error(
-        `C22 positive control FAILED: ratio=${controls.ratioMatcher.matched} identifier=${controls.identifierMatcher.matched} \u2014 matcher broken, verdict untrustworthy`
-      );
-    }
-    if (!controls.identifierClearsBareRatio) {
-      throw new Error(
-        "C22 identifier-matcher control FAILED: must NOT flag a bare ratio with no identifier token \u2014 verdict untrustworthy"
-      );
-    }
-    const hits = findRatioCitations(tree.root);
-    if (hits.length === 0) {
-      return {
-        id: this.id,
-        anchor: "-",
-        state: "absent",
-        verdict: "no test/coverage ratio cited in README/CHANGELOG; test-ratio-gate check n/a"
-      };
-    }
-    const bare = hits.find((h) => !h.hasIdentifier);
-    if (bare) {
+    const unreadable = [];
+    const decided = (() => {
+      const controls = c22PositiveControls();
+      if (!controls.ratioMatcher.matched || !controls.identifierMatcher.matched) {
+        throw new Error(
+          `C22 positive control FAILED: ratio=${controls.ratioMatcher.matched} identifier=${controls.identifierMatcher.matched} \u2014 matcher broken, verdict untrustworthy`
+        );
+      }
+      if (!controls.identifierClearsBareRatio) {
+        throw new Error(
+          "C22 identifier-matcher control FAILED: must NOT flag a bare ratio with no identifier token \u2014 verdict untrustworthy"
+        );
+      }
+      const hits = findRatioCitations(tree.root, unreadable);
+      if (hits.length === 0) {
+        return {
+          id: this.id,
+          anchor: "-",
+          state: "absent",
+          verdict: "no test/coverage ratio cited in README/CHANGELOG; test-ratio-gate check n/a"
+        };
+      }
+      const bare = hits.find((h) => !h.hasIdentifier);
+      if (bare) {
+        return {
+          id: this.id,
+          anchor: `${bare.file}:${bare.line}`,
+          state: "non-conforming",
+          verdict: `ratio cited at ${bare.file}:${bare.line} ("${bare.raw.trim()}") carries no passage-identifier token (positive-control OK) -> cite the automatic run/commit identifier the ratio was produced by (C-22)`
+        };
+      }
+      const withId = hits[0];
+      const reason = `ratio cited at ${withId.file}:${withId.line} carries an identifier-shaped token, but whether it RESOLVES against a live CI run is the gate half of C-22 \u2014 this static-only run has no CI query surface and cannot confirm resolution`;
       return {
         id: this.id,
-        anchor: `${bare.file}:${bare.line}`,
-        state: "non-conforming",
-        verdict: `ratio cited at ${bare.file}:${bare.line} ("${bare.raw.trim()}") carries no passage-identifier token (positive-control OK) -> cite the automatic run/commit identifier the ratio was produced by (C-22)`
+        anchor: `${withId.file}:${withId.line}`,
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
       };
-    }
-    const withId = hits[0];
-    const reason = `ratio cited at ${withId.file}:${withId.line} carries an identifier-shaped token, but whether it RESOLVES against a live CI run is the gate half of C-22 \u2014 this static-only run has no CI query surface and cannot confirm resolution`;
-    return {
-      id: this.id,
-      anchor: `${withId.file}:${withId.line}`,
-      state: "could-not-judge",
-      reason,
-      verdict: `could not judge: ${reason}`
-    };
+    })();
+    return settle(this.id, decided, unreadable);
   }
 };
 
@@ -6605,14 +6842,21 @@ var c24AcceptanceAtDispatch = {
         `C24 positive control FAILED: ${JSON.stringify(ctl)} \u2014 the dispatch matcher cannot tell an instrument job from another, verdict untrustworthy`
       );
     }
-    const docs = diskText(tree, (_name, rel) => DISPATCH_PATH_RE.test(rel)).filter(
-      (d) => INSTRUMENT_RE.test(d.text) && ACTION_RE.test(d.text)
+    const candidates = diskText(tree, (_name, rel) => DISPATCH_PATH_RE.test(rel));
+    const docs = candidates.filter((d) => INSTRUMENT_RE.test(d.text) && ACTION_RE.test(d.text));
+    const unreadDocs = refusedAsUnreadable(
+      candidates.refused,
+      "it may be an instrument dispatch document, so it is unread"
     );
     if (docs.length === 0) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "no instrument dispatch document (task / dispatch / brief / issue template naming a detector or conformance instrument and an action on it) in the tree \u2014 C-24 static half n/a; the gate half is the delivery gate's (positive control OK)"
+        absentResult(
+          this.id,
+          "-",
+          "no instrument dispatch document (task / dispatch / brief / issue template naming a detector or conformance instrument and an action on it) in the tree \u2014 C-24 static half n/a; the gate half is the delivery gate's (positive control OK)"
+        ),
+        unreadDocs
       );
     }
     const lacking = docs.filter((d) => !hasAcceptanceBlock(d.text));
@@ -6949,7 +7193,7 @@ import {
   readFileSync as readFileSync9,
   readdirSync as readdirSync6,
   rmSync,
-  statSync as statSync5,
+  statSync as statSync10,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
@@ -6975,15 +7219,17 @@ function walkForConfigs(dir, depth, seen, onSkip) {
   let entries;
   try {
     entries = readdirSync6(dir);
-  } catch {
+  } catch (err) {
+    onSkip(dir, depth, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
     return;
   }
   for (const name of entries) {
     const full = join9(dir, name);
     let st;
     try {
-      st = statSync5(full);
-    } catch {
+      st = statSync10(full);
+    } catch (err) {
+      onSkip(full, depth + 1, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
       continue;
     }
     if (st.isDirectory()) {
@@ -6993,6 +7239,10 @@ function walkForConfigs(dir, depth, seen, onSkip) {
       }
       walkForConfigs(full, depth + 1, seen, onSkip);
     } else if (DEPLOY_CONFIG_FILES.includes(name)) {
+      if (!st.isFile()) {
+        onSkip(full, depth + 1, "not a regular file (FIFO, socket or device) \u2014 not read");
+        continue;
+      }
       if (!seen.has(dir)) {
         seen.set(dir, { dir, configFile: name, configPath: full });
       }
@@ -7012,7 +7262,7 @@ function probeForCandidate(dir, depth) {
     const full = join9(dir, name);
     let st;
     try {
-      st = statSync5(full);
+      st = statSync10(full);
     } catch {
       continue;
     }
@@ -7054,12 +7304,12 @@ function resolveRailwayRootDirectory(configPath) {
 function c26DeriveScope(root, tree) {
   const seen = /* @__PURE__ */ new Map();
   const skipped = [];
-  const onSkip = (skippedDir, depth) => {
-    const entry = tree ? recordSkip(tree, skippedDir, root) : {
+  const onSkip = (skippedDir, depth, reason) => {
+    const entry = tree ? recordSkip(tree, skippedDir, root, reason) : {
       path: relative5(root, skippedDir).split(sep4).join("/"),
-      reason: SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
+      reason: reason ?? SKIP_DIR_INFO[basename2(skippedDir)]?.reason ?? "skipped"
     };
-    if (SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
+    if (reason === void 0 && SKIP_DIR_INFO[basename2(skippedDir)]?.authored) {
       const hit = probeForCandidate(skippedDir, depth);
       if (hit) entry.candidate = relative5(root, hit).split(sep4).join("/");
     }
@@ -7185,8 +7435,22 @@ function gateSite(site) {
   }
   const isolated = mkdtempSync(join9(tmpdir(), "mcp-doctor-c26-"));
   try {
-    const manifestText = readFileSync9(pkgPath, "utf8");
-    const lockText = readFileSync9(join9(site.dir, lock.name), "utf8");
+    let manifestText;
+    let lockText;
+    const lockPath = join9(site.dir, lock.name);
+    try {
+      for (const p of [pkgPath, lockPath]) {
+        if (!statSync10(p).isFile()) throw new Error(`${p} is not a regular file`);
+      }
+      manifestText = readFileSync9(pkgPath, "utf8");
+      lockText = readFileSync9(lockPath, "utf8");
+    } catch (err) {
+      return {
+        site,
+        status: "unreadable",
+        reason: `${site.dir}: package.json or ${lock.name} is present but cannot be read (${err instanceof Error ? err.message : String(err)}) \u2014 the frozen install was not run`
+      };
+    }
     writeFileSync(join9(isolated, "package.json"), manifestText);
     writeFileSync(join9(isolated, lock.name), lockText);
     let proc;
@@ -7247,6 +7511,7 @@ function renderCoverage(scope, verdicts) {
   return verdicts.map((v) => {
     const rel = relative5(process.cwd(), v.site.dir) || v.site.dir;
     if (v.status === "skipped") return `SKIPPED ${rel} (${v.reason})`;
+    if (v.status === "unreadable") return `UNREAD ${rel} (${v.reason})`;
     return `ANALYSED ${rel} -> ${v.ok ? "GREEN" : "RED"}: ${v.detail}`;
   }).join(" | ");
 }
@@ -7289,6 +7554,17 @@ var c26SubpackageLockfile = {
     const verdicts = scope.sites.map(gateSite);
     const inventory = renderCoverage(scope.sites, verdicts);
     const analysed = verdicts.filter((v) => v.status === "analysed");
+    const unread = verdicts.filter((v) => v.status === "unreadable");
+    if (unread.length > 0 && !analysed.some((v) => v.ok === false)) {
+      const reason = `${unread.length} deployable site(s) could not be read \u2014 ${unread.map((v) => v.reason).join("; ")}. Coverage: ${inventory}`;
+      return {
+        id: this.id,
+        anchor: unread[0].site.dir,
+        state: "could-not-judge",
+        reason,
+        verdict: `could not judge: ${reason}`
+      };
+    }
     if (analysed.length === 0) {
       if (hidden.length > 0) return unjudgedHidden("no analysable site; ");
       return {
@@ -7428,22 +7704,21 @@ var c27SubpackageTypes = {
     const workflows = governingWorkflows(tree);
     const reds = [];
     const oks = [];
+    const unreadDocs = [];
     for (const site of tsSites) {
       const siteRel = relative6(base, site.dir) || ".";
       const docs = [];
       const dockerfile = join10(site.dir, "Dockerfile");
       if (existsSync9(dockerfile)) {
-        docs.push({
-          where: `${siteRel}/Dockerfile`,
-          segments: dockerSegments(readText(dockerfile) ?? "")
-        });
+        const text = readText(dockerfile);
+        if (text === null) unreadDocs.push(`${siteRel}/Dockerfile`);
+        else docs.push({ where: `${siteRel}/Dockerfile`, segments: dockerSegments(text) });
       }
       const railway = join10(site.dir, "railway.json");
       if (existsSync9(railway)) {
-        docs.push({
-          where: `${siteRel}/railway.json`,
-          segments: railwayBuildCommand(readText(railway) ?? "")
-        });
+        const text = readText(railway);
+        if (text === null) unreadDocs.push(`${siteRel}/railway.json`);
+        else docs.push({ where: `${siteRel}/railway.json`, segments: railwayBuildCommand(text) });
       }
       for (const w of workflows) {
         if (siteRel === "." || w.text.includes(siteRel)) {
@@ -7456,6 +7731,7 @@ var c27SubpackageTypes = {
         oks.push(`${ok.d.where} (${siteRel})`);
         continue;
       }
+      if (unreadDocs.some((u) => u.startsWith(`${siteRel}/`))) continue;
       const unfrozen = verdicts.find((v) => v.phase === "unfrozen");
       const early = verdicts.find((v) => v.phase === "before-install");
       const why = unfrozen ? `a type check follows a non-frozen install at ${unfrozen.d.where} (the tree is not the lockfile's: use a frozen install)` : early ? `a type check at ${early.d.where} runs before any install (it checks the workspace's tree, not the isolation's)` : "no type check runs in the deployment isolation (no tsc / typecheck step after a frozen install)";
@@ -7468,6 +7744,13 @@ var c27SubpackageTypes = {
         `${reds.length} TypeScript deployable(s): ${reds.join("; ")} -> run the sub-package type check inside the isolation the deployment installs, after the frozen install (C-27)`
       );
     }
+    if (unreadDocs.length > 0) {
+      return couldNotJudge(
+        this.id,
+        `${unreadDocs[0]}:1`,
+        `${unreadDocs.map((u) => `\`${u}\``).join(", ")} is present but cannot be read (permission, or not a regular file): whether the deployment type-checks in its isolation is unread \u2014 never "no type check" (C-27)`
+      );
+    }
     return couldNotJudge(
       this.id,
       oks[0],
@@ -7605,7 +7888,10 @@ var c29ServedSkills = {
     const missing = [...methods].filter(([, a]) => a.length === 0).map(([m]) => m);
     const reds = [];
     const helpers = helperImports(tree, /skill/i);
-    const unreadable = [...surface.unreadable];
+    const unreadable = [
+      ...surface.unreadable,
+      ...refusedAsUnreadable(skillFiles.refused, "its name was not compared to its directory")
+    ];
     if (missing.length > 0) {
       if (helpers.length > 0) {
         unreadable.push({
@@ -7697,7 +7983,7 @@ var c30SkillsOrgBound = {
 };
 
 // src/detectors/c31-plugin-installable.ts
-import { existsSync as existsSync10, readdirSync as readdirSync8, statSync as statSync6 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync8, statSync as statSync11 } from "fs";
 import { basename as basename3, dirname as dirname4, join as join11, relative as relative8, sep as sep5 } from "path";
 var MIN_README_WORDS = 40;
 var KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -7898,12 +8184,17 @@ function judgeFolder(tree, folder, manifestPath2, out) {
   }
   const hasLicenseField = typeof manifest.license === "string" && manifest.license.trim() !== "";
   let hasLicenseFile = false;
+  let folderListed = true;
   try {
     hasLicenseFile = readdirSync8(folder).some((n) => /^LICEN[CS]E/i.test(n));
-  } catch {
-    hasLicenseFile = false;
+  } catch (err) {
+    folderListed = false;
+    out.unreadable.push({
+      anchor: rel(folder),
+      reason: `${rel(folder)} cannot be listed (${fsErrorCode(err)}) \u2014 whether it carries a LICENSE file is unread`
+    });
   }
-  if (!hasLicenseField && !hasLicenseFile) {
+  if (!hasLicenseField && !hasLicenseFile && folderListed) {
     out.reds.push({
       anchor: a,
       text: "no licence: plugin.json has no `license` and the folder has no LICENSE file"
@@ -7911,7 +8202,12 @@ function judgeFolder(tree, folder, manifestPath2, out) {
   }
   const readmePath = join11(folder, "README.md");
   const readme = readText(readmePath);
-  if (readme === null) {
+  if (readme === null && existsSync10(readmePath)) {
+    out.unreadable.push({
+      anchor: rel(readmePath),
+      reason: `${rel(readmePath)} is present but cannot be read as text (permission, or not a regular file) \u2014 its length and credential content are unread`
+    });
+  } else if (readme === null) {
     out.reds.push({ anchor: rel(folder), text: "no README.md at the plugin folder root" });
   } else {
     const n = proseWordCount(readme);
@@ -7971,13 +8267,20 @@ function judgeFolder(tree, folder, manifestPath2, out) {
     judgeServers(servers, mcpAnchor, out);
   }
   try {
-    if (statSync6(join11(folder, "bin")).isDirectory()) {
+    if (statSync11(join11(folder, "bin")).isDirectory()) {
       out.reds.push({
         anchor: rel(join11(folder, "bin")),
         text: "a top-level bin/ directory (a plugin ships no bin/ at its top level)"
       });
     }
-  } catch {
+  } catch (err) {
+    const code = fsErrorCode(err);
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      out.unreadable.push({
+        anchor: rel(join11(folder, "bin")),
+        reason: `${rel(join11(folder, "bin"))} could not be probed (${code}) \u2014 whether the plugin ships a top-level bin/ is unread`
+      });
+    }
   }
   const jsons = [[a, manifest]];
   if (servers) jsons.push([mcpAnchor, servers]);
@@ -8007,14 +8310,18 @@ var c31PluginInstallable = {
       tree,
       (_n, rel) => rel === ".claude-plugin/plugin.json" || rel.endsWith("/.claude-plugin/plugin.json")
     );
+    const refusedManifests = refusedAsUnreadable(
+      manifests.refused,
+      "this plugin folder's manifest is unread, so it was not judged"
+    );
     if (manifests.length === 0) {
       return couldNotJudge(
         this.id,
-        tree.root,
-        `no plugin folder could be located under ${tree.root} (a directory holding .claude-plugin/plugin.json) \u2014 whether the object installs as a Claude plugin is unjudged (C-31)`
+        refusedManifests[0]?.anchor ?? tree.root,
+        refusedManifests.length > 0 ? `${refusedManifests.map((u) => u.reason).join("; ")} \u2014 whether the object installs as a Claude plugin is unjudged (C-31)` : `no plugin folder could be located under ${tree.root} (a directory holding .claude-plugin/plugin.json) \u2014 whether the object installs as a Claude plugin is unjudged (C-31)`
       );
     }
-    const out = { reds: [], unreadable: [] };
+    const out = { reds: [], unreadable: [...refusedManifests] };
     for (const m of manifests) judgeFolder(tree, dirname4(dirname4(m.path)), m.path, out);
     const anchor = manifests[0].rel;
     if (out.reds.length > 0) {
@@ -8484,9 +8791,10 @@ function sdkV2Range(tree) {
   }
   return null;
 }
+var isManifest = (n) => n === "mcp.json" || n === "mcp-server.json";
 function triggers(tree) {
   const out = [];
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  for (const f of findDiskFiles(tree, isManifest)) {
     const j = readJsonRecord(f.path);
     if (!j || isRecord(j.mcpServers)) continue;
     const v = j.minProtocolVersion;
@@ -8559,12 +8867,19 @@ var d5 = {
         verdict: `no server/discover handler (grep=0, positive-control OK) although this server targets ${TARGET}: ${why.join("; ")} -> respond to server/discover with supportedVersions and capabilities, and announce the same capability set as initialize (S-4)`
       };
     }
-    return {
-      id: this.id,
-      anchor: "-",
-      state: "absent",
-      verdict: "no server/discover handler (grep=0, positive-control OK); no closed trigger found (no manifest minProtocolVersion >= 2026-07-28, no events capability, no host extension) -> S-4 does not oblige; add via protocol-kit when targeting 2026-07-28"
-    };
+    return settle(
+      this.id,
+      {
+        id: this.id,
+        anchor: "-",
+        state: "absent",
+        verdict: "no server/discover handler (grep=0, positive-control OK); no closed trigger found (no manifest minProtocolVersion >= 2026-07-28, no events capability, no host extension) -> S-4 does not oblige; add via protocol-kit when targeting 2026-07-28"
+      },
+      refusedAsUnreadable(
+        findDiskFiles(tree, isManifest).refused,
+        "its minProtocolVersion (the trigger of S-4) is unread"
+      )
+    );
   }
 };
 
@@ -8757,7 +9072,7 @@ var d7Inner = {
 var d7 = guardUnreadablePackageJson(d7Inner, { authoritative: true });
 
 // src/detectors/d8.ts
-import { existsSync as existsSync11, statSync as statSync7 } from "fs";
+import { existsSync as existsSync11, statSync as statSync12 } from "fs";
 import { dirname as dirname5, join as join12, relative as relative9 } from "path";
 var POSITIVE_CONTROL2 = 'server.registerTool("list_items", { ... }, handler);';
 function d8PositiveControl() {
@@ -8770,7 +9085,7 @@ function d8PositiveControl() {
 function resolveBaseDir(tree) {
   if (tree.packageJson) return dirname5(tree.packageJson.path);
   try {
-    return statSync7(tree.root).isDirectory() ? tree.root : dirname5(tree.root);
+    return statSync12(tree.root).isDirectory() ? tree.root : dirname5(tree.root);
   } catch {
     return tree.root;
   }
@@ -8904,6 +9219,13 @@ var d8 = {
         verdict: "server advertises no tools at runtime -> n/a for eval coverage"
       };
     }
+    if (runtime.evalsUnreadable) {
+      return couldNotJudge(
+        this.id,
+        `${runtime.root} (runtime tools/list)`,
+        `the eval file is present but unread \u2014 ${runtime.evalsUnreadable}; per-tool coverage is unknown, never zero (Server Rule 5)`
+      );
+    }
     const summary = runtime.tools.map((t) => `${t.name}=${t.evalCaseCount ?? 0}`).join(" ");
     const under = runtime.tools.filter((t) => (t.evalCaseCount ?? 0) < 3);
     if (under.length > 0) {
@@ -9529,7 +9851,7 @@ var d15 = {
 };
 
 // src/detectors/d16.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync13 } from "fs";
 import { dirname as dirname8, join as join15 } from "path";
 var DISCOVER_RE2 = /server\/discover|DiscoverResult|ServerDiscover|handleServerDiscover/;
 var HEALTH_ROUTE_FRAMEWORK_RE = /\b[A-Za-z_$][\w$]*\.(?:get|post|put|patch|delete|all|route|use)\s*\(\s*["'`][^"'`]*\/health/;
@@ -9851,10 +10173,11 @@ var d16 = {
 };
 function readPackageVersion(root) {
   try {
-    let dir = statSync8(root).isDirectory() ? root : dirname8(root);
+    let dir = statSync13(root).isDirectory() ? root : dirname8(root);
     for (let depth = 0; depth < 8; depth++) {
       const candidate = join15(dir, "package.json");
       if (existsSync14(candidate)) {
+        if (!statSync13(candidate).isFile()) return null;
         const pkg = JSON.parse(readFileSync10(candidate, "utf8"));
         return typeof pkg.version === "string" ? pkg.version : null;
       }
@@ -9869,7 +10192,7 @@ function readPackageVersion(root) {
 }
 
 // src/detectors/dAppI18n.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync14 } from "fs";
 import { dirname as dirname9, join as join16 } from "path";
 function flattenKeys(obj, prefix = "") {
   if (obj === null || typeof obj !== "object" || Array.isArray(obj)) {
@@ -9903,6 +10226,7 @@ function dAppI18nPositiveControls() {
 }
 function readJson2(path) {
   try {
+    if (!statSync14(path).isFile()) return { ok: false };
     return { ok: true, value: JSON.parse(readFileSync11(path, "utf8")) };
   } catch {
     return { ok: false };
@@ -10101,14 +10425,14 @@ var dDebugOptIn = {
 };
 
 // src/detectors/extManifests.ts
-import { readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { readdirSync as readdirSync9, statSync as statSync15 } from "fs";
 import { join as join17 } from "path";
 function findExtensionManifests(tree) {
   const out = [];
   const root = tree.root;
   let base;
   try {
-    base = statSync9(root).isDirectory() ? root : join17(root, "..");
+    base = statSync15(root).isDirectory() ? root : join17(root, "..");
   } catch {
     return out;
   }
@@ -10116,15 +10440,17 @@ function findExtensionManifests(tree) {
     let entries;
     try {
       entries = readdirSync9(dir);
-    } catch {
+    } catch (err) {
+      recordSkip(tree, dir, base, `could not be listed (${fsErrorCode(err)}) \u2014 not read`);
       return;
     }
     for (const name of entries) {
       const full = join17(dir, name);
       let st;
       try {
-        st = statSync9(full);
-      } catch {
+        st = statSync15(full);
+      } catch (err) {
+        recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
         continue;
       }
       if (st.isDirectory()) {
@@ -10134,6 +10460,10 @@ function findExtensionManifests(tree) {
         }
         walk2(full);
       } else if (name === "extension.json") {
+        if (!st.isFile()) {
+          recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+          continue;
+        }
         out.push(full);
       }
     }
@@ -10750,8 +11080,8 @@ var dExt3 = {
 };
 
 // src/detectors/dExt4.ts
-import { readdirSync as readdirSync10, statSync as statSync10 } from "fs";
-import { join as join19 } from "path";
+import { readdirSync as readdirSync10, statSync as statSync16 } from "fs";
+import { join as join19, relative as relative10 } from "path";
 function canonical(name) {
   return name.replace(/[-_]/g, "").toLowerCase();
 }
@@ -10770,28 +11100,39 @@ function dExt4PositiveControls() {
     }
   };
 }
-function findHooksDirs(tree) {
+function findHooksDirs(tree, unreadable, gaps) {
   const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync10(root).isDirectory() ? root : join19(root, "..");
+    base = statSync16(root).isDirectory() ? root : join19(root, "..");
   } catch {
     return out;
   }
+  const noteUnread = (path, what, err) => {
+    gaps.count++;
+    const anchor = relative10(base, path) || ".";
+    const reason = `${anchor} ${what} (${fsErrorCode(err)}) \u2014 a hooks/ directory under it may exist unseen, so the implemented hooks are unverifiable (Extension Rule 4)`;
+    if (!unreadable.some((u) => u.anchor === anchor && u.reason === reason)) {
+      unreadable.push({ anchor, reason });
+    }
+  };
   const walk2 = (dir) => {
     let entries;
     try {
       entries = readdirSync10(dir);
-    } catch {
+    } catch (err) {
+      noteUnread(dir, "could not be listed", err);
       return;
     }
     for (const name of entries) {
       const full = join19(dir, name);
       let st;
       try {
-        st = statSync10(full);
-      } catch {
+        st = statSync16(full);
+      } catch (err) {
+        if (fsErrorCode(err) !== "ENOENT" && fsErrorCode(err) !== "ELOOP")
+          noteUnread(full, "could not be read", err);
         continue;
       }
       if (!st.isDirectory()) continue;
@@ -10804,7 +11145,8 @@ function findHooksDirs(tree) {
         let files;
         try {
           files = readdirSync10(full);
-        } catch {
+        } catch (err) {
+          noteUnread(full, "could not be listed", err);
           files = [];
         }
         for (const f of files) {
@@ -10882,7 +11224,8 @@ var dExt4 = {
     }
     const unreadable = [];
     const decided = (() => {
-      const hooksDirs = findHooksDirs(tree);
+      const hooksDirGaps = { count: 0 };
+      const hooksDirs = findHooksDirs(tree, unreadable, hooksDirGaps);
       const { sites, unresolved } = findFactorySites(tree);
       for (const anchor of unresolved) {
         unreadable.push({
@@ -10926,6 +11269,7 @@ var dExt4 = {
           continue;
         }
         const phantom = [...declared].filter((h) => !implemented.has(h));
+        if (phantom.length > 0 && hooksDirGaps.count > 0) continue;
         if (phantom.length > 0) {
           return {
             id: this.id,
@@ -11313,30 +11657,41 @@ var dExt8 = {
 };
 
 // src/detectors/dExt9.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync11, statSync as statSync11 } from "fs";
-import { join as join23 } from "path";
-function collectHooksDirSources(tree, unreadable) {
+import { readFileSync as readFileSync13, readdirSync as readdirSync11, statSync as statSync17 } from "fs";
+import { join as join23, relative as relative11 } from "path";
+function collectHooksDirSources(tree, unreadable, gaps) {
   const root = tree.root;
   const out = [];
   let base;
   try {
-    base = statSync11(root).isDirectory() ? root : join23(root, "..");
+    base = statSync17(root).isDirectory() ? root : join23(root, "..");
   } catch {
     return out;
   }
+  const noteUnread = (path, what, err) => {
+    gaps.count++;
+    const anchor = relative11(base, path) || ".";
+    const reason = `${anchor} ${what} (${fsErrorCode(err)}) \u2014 a hooks/ directory under it may exist unseen, so the timeout guards are undeterminable (Extension Rule 9)`;
+    if (!unreadable.some((u) => u.anchor === anchor && u.reason === reason)) {
+      unreadable.push({ anchor, reason });
+    }
+  };
   const walk2 = (dir) => {
     let entries;
     try {
       entries = readdirSync11(dir);
-    } catch {
+    } catch (err) {
+      noteUnread(dir, "could not be listed", err);
       return;
     }
     for (const name of entries) {
       const full = join23(dir, name);
       let st;
       try {
-        st = statSync11(full);
-      } catch {
+        st = statSync17(full);
+      } catch (err) {
+        if (fsErrorCode(err) !== "ENOENT" && fsErrorCode(err) !== "ELOOP")
+          noteUnread(full, "could not be read", err);
         continue;
       }
       if (!st.isDirectory()) continue;
@@ -11348,7 +11703,8 @@ function collectHooksDirSources(tree, unreadable) {
         let files;
         try {
           files = readdirSync11(full);
-        } catch {
+        } catch (err) {
+          noteUnread(full, "could not be listed", err);
           files = [];
         }
         for (const f of files) {
@@ -11358,6 +11714,7 @@ function collectHooksDirSources(tree, unreadable) {
           const filePath = join23(full, f);
           let body;
           try {
+            if (!statSync17(filePath).isFile()) throw new Error("not a regular file");
             body = readFileSync13(filePath, "utf8");
           } catch {
             const shortPath = filePath.split("/").slice(-2).join("/");
@@ -11461,8 +11818,9 @@ var dExt9 = {
     }
     const unreadable = [];
     const decided = (() => {
+      const hooksDirGaps = { count: 0 };
       const hookSources = [
-        ...collectHooksDirSources(tree, unreadable),
+        ...collectHooksDirSources(tree, unreadable, hooksDirGaps),
         ...collectFactorySources(tree)
       ];
       const implByToken = /* @__PURE__ */ new Map();
@@ -11511,6 +11869,7 @@ var dExt9 = {
           const hasImplTimeout = implSources.some((s) => hasImplTimeoutGuard(s.body));
           if (!hasManifestTimeout && !hasImplTimeout) noTimeout.push(hook);
         }
+        if (noTimeout.length > 0 && hooksDirGaps.count > 0) continue;
         if (noTimeout.length > 0) {
           return {
             id: this.id,
@@ -12524,7 +12883,6 @@ var dServer14 = {
 };
 
 // src/detectors/e5-extension-isolation.ts
-import { readFileSync as readFileSync14 } from "fs";
 var GLOBAL_RES = [
   /\b(?:globalThis|global|window|self)\s*(?:\.\s*[\w$]+|\[[^\]]+\])\s*=(?!=)/,
   /Object\.(?:assign|defineProperty|defineProperties|setPrototypeOf)\(\s*(?:globalThis|global|window|self)\b/,
@@ -12555,11 +12913,8 @@ var e5ExtensionIsolation = {
     const manifests = findExtensionManifests(tree);
     const own = /* @__PURE__ */ new Set();
     for (const m of manifests) {
-      try {
-        const j = JSON.parse(readFileSync14(m, "utf8"));
-        if (typeof j.identifier === "string") own.add(j.identifier);
-      } catch {
-      }
+      const j = readJsonObject(m);
+      if (j && typeof j.identifier === "string") own.add(j.identifier);
     }
     const defined = tree.files.some(
       (f) => isProductSource(f.rel) && uncommentedLines(f).some((r) => /\bdefineExtension\s*\(/.test(r))
@@ -12989,8 +13344,8 @@ var e10MrtrOnly = {
 };
 
 // src/detectors/e11-surfaces-derived.ts
-import { existsSync as existsSync20, statSync as statSync12 } from "fs";
-import { dirname as dirname14, join as join24, relative as relative10, sep as sep6 } from "path";
+import { existsSync as existsSync20, statSync as statSync18 } from "fs";
+import { dirname as dirname14, join as join24, relative as relative12, sep as sep6 } from "path";
 var ALL = ["chat", "cowork", "claude-code"];
 function excludedSurfaces(c) {
   const cause = /* @__PURE__ */ new Map();
@@ -13006,10 +13361,17 @@ function excludedSurfaces(c) {
   if (c.localMcp) exclude("chat", "a local MCP command excludes chat");
   return cause;
 }
-function isDir(p) {
+function isDir(p, anchor, unreadable) {
   try {
-    return statSync12(p).isDirectory();
-  } catch {
+    return statSync18(p).isDirectory();
+  } catch (err) {
+    const code = fsErrorCode(err);
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      unreadable.push({
+        anchor,
+        reason: `${anchor} could not be probed (${code}) \u2014 whether this component exists is unread`
+      });
+    }
     return false;
   }
 }
@@ -13027,15 +13389,22 @@ var e11SurfacesDerived = {
       );
     }
     const manifests = findDiskFiles(tree, (n) => n === "extension.json");
+    const unreadable = refusedAsUnreadable(
+      manifests.refused,
+      "its surfaces are unread"
+    );
     if (manifests.length === 0) {
-      return {
-        id: this.id,
-        anchor: "-",
-        state: "absent",
-        verdict: "no extension.json in the tree: the object is not an extension; E-11 n/a"
-      };
+      return settle(
+        this.id,
+        {
+          id: this.id,
+          anchor: "-",
+          state: "absent",
+          verdict: "no extension.json in the tree: the object is not an extension; E-11 n/a"
+        },
+        unreadable
+      );
     }
-    const unreadable = [];
     const reds = [];
     let judged = 0;
     for (const m of manifests) {
@@ -13048,7 +13417,7 @@ var e11SurfacesDerived = {
         continue;
       }
       const folder = dirname14(m.path);
-      const rel = (p) => relative10(tree.root, p).split(sep6).join("/") || ".";
+      const rel = (p) => relative12(tree.root, p).split(sep6).join("/") || ".";
       if (!Array.isArray(j.surfaces)) {
         reds.push({
           anchor: m.rel,
@@ -13084,9 +13453,9 @@ var e11SurfacesDerived = {
         }
       }
       const cause = excludedSurfaces({
-        bin: isDir(join24(folder, "bin")),
-        hooks: isDir(join24(folder, "hooks")),
-        agents: isDir(join24(folder, "agents")),
+        bin: isDir(join24(folder, "bin"), rel(join24(folder, "bin")), unreadable),
+        hooks: isDir(join24(folder, "hooks"), rel(join24(folder, "hooks")), unreadable),
+        agents: isDir(join24(folder, "agents"), rel(join24(folder, "agents")), unreadable),
         localMcp
       });
       for (const s of declared) {
@@ -13123,9 +13492,10 @@ var e11SurfacesDerived = {
 
 // src/detectors/e12-host-capability-placement.ts
 var TARGET2 = "2026-07-28";
+var isManifest2 = (n) => n === "mcp.json" || n === "mcp-server.json";
 function targets2026(tree) {
   if (codeSites(tree, /["'`]2026-07-28["'`]/g).length > 0) return true;
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  for (const f of findDiskFiles(tree, isManifest2)) {
     const j = readJsonRecord(f.path);
     if (!j || isRecord(j.mcpServers)) continue;
     if (typeof j.minProtocolVersion === "string" && j.minProtocolVersion >= TARGET2) return true;
@@ -13182,10 +13552,17 @@ var e12HostCapabilityPlacement = {
       );
     }
     if (targetUnknown) {
-      return couldNotJudge(
+      return settle(
         this.id,
-        r.caps[0].anchor,
-        `${experimentalOnly.join(", ")} is announced only under capabilities.experimental, and nothing in this tree states that the server targets ${TARGET2} (no "${TARGET2}" literal, no manifest minProtocolVersion) \u2014 the placement rule applies only to such a server (E-12)`
+        couldNotJudge(
+          this.id,
+          r.caps[0].anchor,
+          `${experimentalOnly.join(", ")} is announced only under capabilities.experimental, and nothing in this tree states that the server targets ${TARGET2} (no "${TARGET2}" literal, no manifest minProtocolVersion) \u2014 the placement rule applies only to such a server (E-12)`
+        ),
+        refusedAsUnreadable(
+          findDiskFiles(tree, isManifest2).refused,
+          "its minProtocolVersion (the server's target) is unread"
+        )
       );
     }
     return settle(
@@ -14339,6 +14716,10 @@ var s16LocalFootprint = {
     }
     const manifests = diskText(tree, (name) => MANIFESTS.has(name));
     const documented = manifests.some((m) => documentsFootprint(m.text));
+    const unreadManifests = refusedAsUnreadable(
+      manifests.refused,
+      "it may document the file footprint, so it is unread"
+    );
     const sensitive = productHits(tree, SENSITIVE_RE);
     const listens = productHits(tree, LISTEN_RE);
     const transports = productHits(tree, TRANSPORT_RE);
@@ -14356,7 +14737,10 @@ var s16LocalFootprint = {
       );
     }
     const reds = [];
-    if (!documented) {
+    let footprintUnjudged = false;
+    if (!documented && unreadManifests.length > 0) {
+      footprintUnjudged = sensitive.length > 0 || homeReaders.length > 0;
+    } else if (!documented) {
       for (const h of sensitive) {
         reds.push(
           `${h.anchor} names a sensitive path outside any declared object (${h.text.trim().slice(0, 60)}): a local server reads nothing outside its object unless the tool requires it and the manifest documents it`
@@ -14385,6 +14769,13 @@ var s16LocalFootprint = {
         `${reds.join("; ")} (S-16, positive-control OK)`
       );
     }
+    if (footprintUnjudged) {
+      return couldNotJudge(
+        this.id,
+        unreadManifests[0].anchor,
+        `${unreadManifests.map((u) => u.reason).join("; ")}; ${sensitive.length} sensitive path(s) and ${homeReaders.length} home-directory read(s) are in the tree, and whether the manifest documents their footprint is unread (S-16)`
+      );
+    }
     const stdio = transports.some((t) => /StdioServerTransport/.test(t.text));
     const http = transports.some((t) => !/StdioServerTransport/.test(t.text)) || listens.length > 0;
     const socketOnly = listens.length > 0 && listens.every((h) => SOCKET_RE.test(h.text.match(LISTEN_RE)?.[1] ?? ""));
@@ -15432,8 +15823,8 @@ var s27ElicitationFloor = {
 };
 
 // src/detectors/s28-claim-forwarded.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync13 } from "fs";
-import { dirname as dirname15, join as join25, relative as relative11 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync14, readdirSync as readdirSync12, statSync as statSync19 } from "fs";
+import { dirname as dirname15, join as join25, relative as relative13 } from "path";
 var PIN11 = STANDARD_PIN;
 var CLAIM_TOKEN = /\bverified(?:Org|Person)\b/;
 var ANY_CLAIM = /\bverified(?:Actor|Org|Person)\b/g;
@@ -15491,11 +15882,12 @@ function splitTop(m, from, to) {
   if (start < to && m.slice(start, to).trim() !== "") parts.push([start, to]);
   return parts;
 }
-function listTs(dir, out = []) {
+function listTs(dir, unread, out = []) {
   let names;
   try {
     names = readdirSync12(dir);
-  } catch {
+  } catch (err) {
+    unread.push(`${dir} could not be listed (${fsErrorCode(err)})`);
     return out;
   }
   for (const n of names) {
@@ -15503,19 +15895,23 @@ function listTs(dir, out = []) {
     const p = join25(dir, n);
     let st;
     try {
-      st = statSync13(p);
-    } catch {
+      st = statSync19(p);
+    } catch (err) {
+      unread.push(`${p} could not be read (${fsErrorCode(err)})`);
       continue;
     }
-    if (st.isDirectory()) listTs(p, out);
-    else if (n.endsWith(".ts") && !n.endsWith(".test.ts") && !n.endsWith(".d.ts")) out.push(p);
+    if (st.isDirectory()) listTs(p, unread, out);
+    else if (n.endsWith(".ts") && !n.endsWith(".test.ts") && !n.endsWith(".d.ts")) {
+      if (!st.isFile()) unread.push(`${p} is not a regular file \u2014 not read`);
+      else out.push(p);
+    }
   }
   return out;
 }
 function discoverBackend(root) {
   let dir = root;
   try {
-    if (!statSync13(root).isDirectory()) dir = dirname15(root);
+    if (!statSync19(root).isDirectory()) dir = dirname15(root);
   } catch {
     return void 0;
   }
@@ -15528,22 +15924,23 @@ function discoverBackend(root) {
   }
   return void 0;
 }
-function readDoors(backendRoot) {
+function readDoors(backendRoot, unread) {
   const doors = /* @__PURE__ */ new Map();
-  for (const path of listTs(backendRoot)) {
+  for (const path of listTs(backendRoot, unread)) {
     let text;
     try {
-      text = readFileSync15(path, "utf8");
-    } catch {
+      text = readFileSync14(path, "utf8");
+    } catch (err) {
+      unread.push(`${path} could not be read (${fsErrorCode(err)})`);
       continue;
     }
     const file = {
       path,
-      rel: relative11(backendRoot, path),
+      rel: relative13(backendRoot, path),
       lines: text.split("\n").map((raw, i) => ({ n: i + 1, raw, comment: false }))
     };
     const m = masked(file);
-    const module = relative11(backendRoot, path).replace(/\.ts$/, "").split("\\").join("/");
+    const module = relative13(backendRoot, path).replace(/\.ts$/, "").split("\\").join("/");
     const re = /\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:query|mutation|action)\s*\(/g;
     for (let hit = re.exec(m); hit; hit = re.exec(m)) {
       const open = hit.index + hit[0].length - 1;
@@ -15656,7 +16053,9 @@ function scanS28(tree) {
   const scan = { violate: [], conform: [], cnj: [], calls: 0, backend: void 0 };
   const backendRoot = tree.backendRoot ?? discoverBackend(tree.root);
   scan.backend = backendRoot;
-  const doors = backendRoot ? readDoors(backendRoot) : void 0;
+  const unread = [];
+  const doors = backendRoot ? readDoors(backendRoot, unread) : void 0;
+  const unreadNote = unread.length > 0 ? `; backend source NOT read: ${unread.join("; ")}` : "";
   const files = tree.files.map((f) => ({ f, text: rawText(f), m: masked(f) }));
   const actorDoors = /* @__PURE__ */ new Set();
   for (const { text } of files) {
@@ -15776,7 +16175,7 @@ function scanS28(tree) {
       if (!info) {
         scan.cnj.push(
           site(
-            `forwards no verified claim and the door ${door} is not defined in the supplied backend (${backendRoot})`
+            `forwards no verified claim and the door ${door} is not defined in the supplied backend (${backendRoot})${unreadNote}`
           )
         );
         continue;
@@ -16155,6 +16554,17 @@ var s34AccessRecheck = {
         );
       }
     }
+    if (manifests.refused.length > 0) {
+      const named = refusedAsUnreadable(
+        manifests.refused,
+        "its events.accessRecheckSeconds is unread"
+      );
+      return couldNotJudge(
+        this.id,
+        named[0].anchor,
+        `${named.map((u) => u.reason).join("; ")}${seen.length > 0 ? ` (the readable manifests say: ${seen.join("; ")})` : ""}; the recheck window cannot be judged absent or non-positive over a manifest that was not read (S-34)`
+      );
+    }
     const where = manifests[0]?.rel ?? surface.declared.anchor;
     return {
       id: this.id,
@@ -16623,12 +17033,12 @@ var detectors = registered.map(
 
 // src/runtime/launch.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync16, statSync as statSync14 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync15, statSync as statSync20 } from "fs";
 import { dirname as dirname16, isAbsolute, join as join26, resolve as resolve2 } from "path";
 function findPackageDir(target) {
   let dir;
   try {
-    dir = statSync14(target).isDirectory() ? target : dirname16(target);
+    dir = statSync20(target).isDirectory() ? target : dirname16(target);
   } catch {
     return null;
   }
@@ -16658,7 +17068,10 @@ function deriveLaunchPlan(target) {
   }
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync16(join26(pkgDir, "package.json"), "utf8"));
+    if (!statSync20(join26(pkgDir, "package.json")).isFile()) {
+      return { error: `${join26(pkgDir, "package.json")} is not a regular file \u2014 not read` };
+    }
+    pkg = JSON.parse(readFileSync15(join26(pkgDir, "package.json"), "utf8"));
   } catch (err) {
     return {
       error: `could not parse ${join26(pkgDir, "package.json")}: ${err instanceof Error ? err.message : String(err)}`
@@ -16738,6 +17151,7 @@ child.stdout.on("data", (d) => {
   while ((i = buf.indexOf("\n")) >= 0) {
     const line = buf.slice(0, i); buf = buf.slice(i + 1);
     if (!line.trim()) continue;
+    // (a) Not a filesystem read: an in-memory parse of one stdout line. A non-JSON line is legitimately not a JSON-RPC answer (a server may log to stdout); the answers it never gave surface as no-answer outcomes / the 5 s probe deadline, never as a silent pass.
     let msg; try { msg = JSON.parse(line); } catch { continue; }
     // A request or notification FROM the server carries a method: it is not an answer.
     if (msg.method !== undefined) continue;
@@ -16796,29 +17210,41 @@ send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "
 function readEvalCounts(target) {
   const counts = /* @__PURE__ */ new Map();
   const pkgDir = findPackageDir(target) ?? (statSyncSafe(target) ? target : null);
-  if (!pkgDir) return counts;
+  if (!pkgDir) return { counts };
   let dir = pkgDir;
   for (let depth = 0; depth < 8; depth++) {
     const candidate = join26(dir, "evals", "evals.json");
     if (existsSync22(candidate)) {
+      let text;
+      try {
+        if (!statSync20(candidate).isFile()) {
+          return { counts, unreadable: `${candidate} is not a regular file \u2014 not read` };
+        }
+        text = readFileSync15(candidate, "utf8");
+      } catch (err) {
+        return {
+          counts,
+          unreadable: `${candidate} could not be read (${fsErrorCode(err)})`
+        };
+      }
       try {
-        const parsed = JSON.parse(readFileSync16(candidate, "utf8"));
+        const parsed = JSON.parse(text);
         for (const c of parsed.cases ?? []) {
           if (c && typeof c.tool === "string") counts.set(c.tool, (counts.get(c.tool) ?? 0) + 1);
         }
       } catch {
       }
-      return counts;
+      return { counts };
     }
     const parent = dirname16(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return counts;
+  return { counts };
 }
 function statSyncSafe(p) {
   try {
-    return statSync14(p).isDirectory();
+    return statSync20(p).isDirectory();
   } catch {
     return false;
   }
@@ -16926,7 +17352,7 @@ function launchAndIntrospect(target) {
   if (parsed.launchError) {
     return { root: target, tools: [], launchError: parsed.launchError };
   }
-  const evalCounts = readEvalCounts(target);
+  const { counts: evalCounts, unreadable: evalsUnreadable } = readEvalCounts(target);
   const tools = (parsed.tools ?? []).map((t) => {
     const name = t.name;
     const count = evalCounts.get(name);
@@ -16940,6 +17366,7 @@ function launchAndIntrospect(target) {
     tools,
     ...parsed.serverInfo ? { serverInfo: parsed.serverInfo } : {},
     ...expectedCommit ? { expectedCommit } : {},
+    ...evalsUnreadable ? { evalsUnreadable } : {},
     ...Array.isArray(parsed.cursorProbes) ? { cursorProbes: parsed.cursorProbes.map(readCursorProbe) } : {}
   };
 }
@@ -17198,7 +17625,7 @@ var USAGE = [
 function readVersion() {
   try {
     const here = dirname17(fileURLToPath2(import.meta.url));
-    const manifest = JSON.parse(readFileSync17(join27(here, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync16(join27(here, "..", "package.json"), "utf8"));
     return manifest.version ?? null;
   } catch {
     return null;