@vantageos/mcp-doctor 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to `@vantageos/mcp-doctor` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## 0.8.3 — 2026-10-25
+
+### Fixed
+- **A candidate that is present but unreadable is reported as present, never as absent** (task
+  k179q736d89ysaete7fhmshjyd8gzh41, Eta on #60). `findDiskFiles` refused a matched entry that was
+  chmod 000, a FIFO or a dangling link, recorded the skip, and returned nothing for it. Seventeen
+  callers then read that as "not in the tree".
+  - `findDiskFiles` now returns the refused matches alongside the readable files, typed as
+    `.refused`. `diskText` and `readSkillFiles` carry them too.
+  - Every verdict that rests on absence settles a refused match as `could-not-judge` and names the
+    file. That covers 15 converted callers; the other 2 are declared at their site.
+  - A-2 no longer says "no vite.config.* in the tree" for an unreadable config. It also no longer
+    turns an unreadable config into a RED.
+  - A-3, A-4 and A-5 no longer report "not an App" when the only HTML shell is unreadable.
+  - `src/runtime/launch.ts:164`, the parse of a server's stdout line, is classified as legitimate.
+
+  On readable input every verdict is unchanged: four real trees give 101 identical results on 0.8.2
+  and 0.8.3.
+
 ## 0.8.2 — 2026-10-25
 
 ### Fixed

package/dist/doctor.js

@@ -519,6 +519,12 @@ function couldNotJudge(id, anchor, reason, owedVerdict) {
     ...owedVerdict ? { owedVerdict } : {}
   };
 }
+function refusedAsUnreadable(refused, what) {
+  return refused.map((r) => ({
+    anchor: r.rel,
+    reason: `${r.rel} ${r.reason}: ${what}`
+  }));
+}
 function settle(id, decided, unreadable) {
   if (unreadable.length === 0) return decided;
   const named = unreadable.map((u) => `${u.anchor}: ${u.reason}`).join("; ");
@@ -638,6 +644,7 @@ function baseOf(tree) {
 }
 function findDiskFiles(tree, pred) {
   const out = [];
+  const refused = [];
   const base = baseOf(tree);
   const walk2 = (dir) => {
     let entries;
@@ -653,7 +660,10 @@ function findDiskFiles(tree, pred) {
       try {
         st = statSync3(full);
       } catch (err) {
-        recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
+        const why = `could not be read (${fsErrorCode(err)}) \u2014 not read`;
+        recordSkip(tree, full, base, why);
+        const relBad = relative2(base, full).split(sep2).join("/");
+        if (pred(name, relBad)) refused.push({ rel: relBad, reason: why });
         continue;
       }
       if (st.isDirectory()) {
@@ -666,13 +676,17 @@ function findDiskFiles(tree, pred) {
         const rel = relative2(base, full).split(sep2).join("/");
         if (!pred(name, rel)) continue;
         if (!st.isFile()) {
-          recordSkip(tree, full, base, "not a regular file (FIFO, socket or device) \u2014 not read");
+          const why = "not a regular file (FIFO, socket or device) \u2014 not read";
+          recordSkip(tree, full, base, why);
+          refused.push({ rel, reason: why });
           continue;
         }
         try {
           accessSync2(full, constants2.R_OK);
         } catch (err) {
-          recordSkip(tree, full, base, `could not be read (${fsErrorCode(err)}) \u2014 not read`);
+          const why = `could not be read (${fsErrorCode(err)}) \u2014 not read`;
+          recordSkip(tree, full, base, why);
+          refused.push({ rel, reason: why });
           continue;
         }
         out.push({ path: full, rel, name });
@@ -680,7 +694,7 @@ function findDiskFiles(tree, pred) {
     }
   };
   walk2(base);
-  return out;
+  return Object.assign(out, { refused });
 }
 function readText(path) {
   try {
@@ -1710,12 +1724,29 @@ var a2DeclaredDomains = {
       }
     }
     const configs = findDiskFiles(tree, (n) => /^vite\.config\.(ts|js|mjs|cjs|mts)$/.test(n));
-    if (configs.length === 0) {
+    let configUnread = false;
+    for (const r of configs.refused) {
+      configUnread = true;
+      unreadable.push({
+        anchor: r.rel,
+        reason: `${r.rel} ${r.reason}: how the UI bundle is built (single file or not) is unread`
+      });
+    }
+    const texts2 = configs.map((c) => ({ rel: c.rel, text: readText(c.path) }));
+    for (const t of texts2) {
+      if (t.text !== null) continue;
+      configUnread = true;
+      unreadable.push({
+        anchor: t.rel,
+        reason: `${t.rel} could not be read \u2014 how the UI bundle is built (single file or not) is unread`
+      });
+    }
+    if (configs.length === 0 && configs.refused.length === 0) {
       unreadable.push({
         anchor: ui[0].anchor,
         reason: "no vite.config.* in the tree \u2014 how the UI bundle is built (single file or not) is unread"
       });
-    } else if (!configs.some((c) => SINGLEFILE_RE.test(stripComments(readText(c.path) ?? "")))) {
+    } else if (!configUnread && !texts2.some((t) => SINGLEFILE_RE.test(stripComments(t.text ?? "")))) {
       reds.push({
         anchor: configs[0].rel,
         text: `${configs[0].rel} builds the UI without a single-file plugin (vite-plugin-singlefile or an inlining equivalent): the bundle is multi-file`
@@ -2632,11 +2663,14 @@ function productSites(tree, re) {
 }
 function diskText(tree, pred) {
   const out = [];
-  for (const f of findDiskFiles(tree, pred)) {
+  const found = findDiskFiles(tree, pred);
+  const refused = [...found.refused];
+  for (const f of found) {
     const text = readText(f.path);
     if (text !== null) out.push({ ...f, text });
+    else refused.push({ rel: f.rel, reason: "could not be read \u2014 not read" });
   }
-  return out;
+  return Object.assign(out, { refused });
 }
 function governingWorkflows(tree) {
   let dir = baseOf(tree);
@@ -2755,6 +2789,12 @@ function appSurface(tree) {
   const anchor = uiSites[0]?.anchor ?? (uiFiles[0] ? `${uiFiles[0].rel}:1` : `${html[0].rel}:1`);
   return { anchor, uiFiles };
 }
+function unreadHtmlShells(tree) {
+  return refusedAsUnreadable(
+    findDiskFiles(tree, (name) => /\.html?$/i.test(name)).refused,
+    "whether the tree is an App (UI code held in an HTML shell) is unread"
+  );
+}
 function codeOnly(text) {
   return text.replace(/(["'`])((?:\\.|(?!\1)[^\\\n])*)\1(?!\s*:)/g, (_m, q) => `${q}${q}`);
 }
@@ -2814,10 +2854,14 @@ var a3SandboxRespected = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "no UI code, no HTML and no ui:// resource in the tree (positive control OK) \u2014 A-3 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "no UI code, no HTML and no ui:// resource in the tree (positive control OK) \u2014 A-3 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
     const uiRels = new Set(app.uiFiles.map((f) => f.rel));
@@ -2831,7 +2875,11 @@ var a3SandboxRespected = {
         inlineScripts.push({ anchor: `${file.rel}:${line}`, body: m[1] });
       }
     }
-    if (uiRels.size === 0 && htmlShells.length === 0 && inlineScripts.length === 0) {
+    const unreadShells = refusedAsUnreadable(
+      htmlShells.refused,
+      "its <script> blocks (parent-frame access, direct storage) are unread"
+    );
+    if (uiRels.size === 0 && htmlShells.length === 0 && inlineScripts.length === 0 && unreadShells.length === 0) {
       return couldNotJudge(
         this.id,
         app.anchor,
@@ -2867,17 +2915,25 @@ var a3SandboxRespected = {
         }
       }
     }
+    const unreadHtml = refusedAsUnreadable(
+      htmlFiles.refused,
+      "its <script> blocks (parent-frame access, direct storage) are unread"
+    );
     if (reds.length > 0) {
-      return redResult(
+      return settle(
         this.id,
-        reds[0].split(" ")[0],
-        `${reds.join("; ")} (A-3, positive-control OK)`
+        redResult(this.id, reds[0].split(" ")[0], `${reds.join("; ")} (A-3, positive-control OK)`),
+        unreadHtml
       );
     }
-    return presentResult(
+    return settle(
       this.id,
-      app.anchor,
-      `${uiRels.size} UI file(s), ${htmlFiles.length} HTML shell(s) and ${inlineScripts.length} inline script(s) in strings: no parent-frame access, no direct storage \u2014 everything is left to the bridge (positive-control OK); the double-iframe CSP is the host proxy's (A-3)`
+      presentResult(
+        this.id,
+        app.anchor,
+        `${uiRels.size} UI file(s), ${htmlFiles.length} HTML shell(s) and ${inlineScripts.length} inline script(s) in strings: no parent-frame access, no direct storage \u2014 everything is left to the bridge (positive-control OK); the double-iframe CSP is the host proxy's (A-3)`
+      ),
+      unreadHtml
     );
   }
 };
@@ -2903,13 +2959,18 @@ var a4WcagGate = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-4 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-4 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
-    const noUiCode = app.uiFiles.length === 0 && findDiskFiles(tree, (name) => /\.html?$/i.test(name)).length === 0;
+    const htmlShells = findDiskFiles(tree, (name) => /\.html?$/i.test(name));
+    const noUiCode = app.uiFiles.length === 0 && htmlShells.length === 0;
     const pkgs = diskText(tree, (name) => name === "package.json");
     const unreadable = [];
     let dep = null;
@@ -2934,11 +2995,17 @@ var a4WcagGate = {
     const workflowRun = governingWorkflows(tree).find(
       (w) => /\baxe\b|axe-core/i.test(stripYamlComments(w.text))
     );
-    const testRun = diskText(tree, (name) => /\.(?:test|spec)\.[jt]sx?$/.test(name)).find(
+    const testFiles = diskText(tree, (name) => /\.(?:test|spec)\.[jt]sx?$/.test(name));
+    const testRun = testFiles.find(
       (f) => /\baxe\b|axe-core|jest-axe|vitest-axe/i.test(stripJsComments(f.text))
     );
+    const refusedInputs = [
+      ...refusedAsUnreadable(pkgs.refused, "its axe dependency and scripts are unread"),
+      ...refusedAsUnreadable(testFiles.refused, "a test file that may run axe is unread"),
+      ...refusedAsUnreadable(htmlShells.refused, "an HTML shell of the App is unread")
+    ];
     const run = scriptRun ?? (workflowRun ? workflowRun.rel : null) ?? (testRun ? testRun.rel : null);
-    if (noUiCode && dep === null && run === null && unreadable.length === 0) {
+    if (noUiCode && dep === null && run === null && unreadable.length === 0 && refusedInputs.length === 0) {
       return couldNotJudge(
         this.id,
         app.anchor,
@@ -2952,6 +3019,13 @@ var a4WcagGate = {
         `${unreadable.join(", ")} is present but could not be parsed (not valid JSON): the axe dependency and the scripts it lists are unreadable, so neither "no gate" nor "a gate" can be said${run === null ? "" : ` (a run was found at ${run})`}; owed: a parsable manifest, then an axe gate that CI runs with 0 blocking WCAG AA violations (A-4)`
       );
     }
+    if (run === null && refusedInputs.length > 0) {
+      return couldNotJudge(
+        this.id,
+        `${refusedInputs[0].anchor}:1`,
+        `${refusedInputs.map((u) => u.reason).join("; ")}: neither "no gate" nor "an axe dependency that nothing runs" can be said over an input that was not read${dep === null ? "" : ` (${dep} is declared)`}; owed: a readable input, then an axe gate that CI runs with 0 blocking WCAG AA violations (A-4)`
+      );
+    }
     if (dep === null && run === null) {
       return redResult(
         this.id,
@@ -3052,10 +3126,14 @@ var a5PerformanceBudgets = {
     }
     const app = appSurface(tree);
     if (app === null) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-5 n/a"
+        absentResult(
+          this.id,
+          "-",
+          "not an App (no UI code, no HTML, no ui:// resource; positive control OK) \u2014 A-5 n/a"
+        ),
+        unreadHtmlShells(tree)
       );
     }
     const { bundles, unmeasured } = collect(baseOf(tree));
@@ -3244,7 +3322,14 @@ function codeBlockAfter(file, line, col, open, close) {
 function scanCapabilities(tree) {
   const caps = [];
   const unreadable = [];
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  const manifests = findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json");
+  for (const r of manifests.refused) {
+    unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: its declared capabilities are unread`
+    });
+  }
+  for (const f of manifests) {
     const json = readJsonRecord(f.path);
     if (!json) {
       unreadable.push({
@@ -3445,7 +3530,14 @@ function collectNamespacedKeys(tree) {
   for (const site of codeSites(tree, META_BRACKET_RE)) {
     acc.keys.push({ key: site.match[2], anchor: site.anchor, context: "_meta", source: "code" });
   }
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  const manifests = findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json");
+  for (const r of manifests.refused) {
+    acc.unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: its capability keys are unread`
+    });
+  }
+  for (const f of manifests) {
     const json = readJsonRecord(f.path);
     if (!json) {
       acc.unreadable.push({
@@ -3578,17 +3670,25 @@ function assertSkillsControl(id) {
   }
 }
 function readSkillFiles(tree) {
-  return findDiskFiles(tree, (n) => n === "SKILL.md").map((f) => {
-    const text = readText(f.path) ?? "";
+  const found = findDiskFiles(tree, (n) => n === "SKILL.md");
+  const files = [];
+  const refused = [...found.refused];
+  for (const f of found) {
+    const text = readText(f.path);
+    if (text === null) {
+      refused.push({ rel: f.rel, reason: "could not be read \u2014 not read" });
+      continue;
+    }
     const parts = f.rel.split("/");
-    return {
+    files.push({
       path: f.path,
       rel: f.rel,
       dir: parts[parts.length - 2] ?? "",
       name: frontmatterName(text),
       text
-    };
-  });
+    });
+  }
+  return Object.assign(files, { refused });
 }
 
 // src/detectors/a8-ui-skills-disjoint.ts
@@ -3635,7 +3735,12 @@ var a8UiSkillsDisjoint = {
         });
       }
     }
-    for (const sf of readSkillFiles(tree)) {
+    const skillFiles = readSkillFiles(tree);
+    const unreadSkills = refusedAsUnreadable(
+      skillFiles.refused,
+      "its frontmatter (a ui:// reference) is unread"
+    );
+    for (const sf of skillFiles) {
       const fm = sf.text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       const hit = fm?.[1].match(/ui:\/\/\S+/);
       if (hit)
@@ -3645,17 +3750,25 @@ var a8UiSkillsDisjoint = {
         });
     }
     if (reds.length > 0) {
-      return {
-        id: this.id,
-        anchor: reds[0].anchor,
-        state: "non-conforming",
-        verdict: `${reds.map((r) => r.text).join("; ")} -> skills are plain markdown under the Skills extension, UI resources live under ui://, the two sets never overlap (A-8)`
-      };
+      return settle(
+        this.id,
+        {
+          id: this.id,
+          anchor: reds[0].anchor,
+          state: "non-conforming",
+          verdict: `${reds.map((r) => r.text).join("; ")} -> skills are plain markdown under the Skills extension, UI resources live under ui://, the two sets never overlap (A-8)`
+        },
+        unreadSkills
+      );
     }
-    return couldNotJudge(
+    return settle(
       this.id,
-      surface.anchor,
-      "no source literal mixes the two spaces; owed (dynamic): skills/list and the ui:// resource list, compared \u2014 no manifest uri uses the UI scheme or equals a listed UI resource, no skills/list entry starts with ui:// (A-8)"
+      couldNotJudge(
+        this.id,
+        surface.anchor,
+        "no source literal mixes the two spaces; owed (dynamic): skills/list and the ui:// resource list, compared \u2014 no manifest uri uses the UI scheme or equals a listed UI resource, no skills/list entry starts with ui:// (A-8)"
+      ),
+      unreadSkills
     );
   }
 };
@@ -5036,7 +5149,14 @@ function sameFileConstObject(file, name) {
 }
 function ceilingCensus(tree) {
   const census = { readable: [], partial: [], unreadable: [] };
-  for (const f of findDiskFiles(tree, (n) => SERVER_MANIFEST_NAMES.has(n))) {
+  const manifests = findDiskFiles(tree, (n) => SERVER_MANIFEST_NAMES.has(n));
+  for (const r of manifests.refused) {
+    census.unreadable.push({
+      anchor: r.rel,
+      reason: `${r.rel} ${r.reason}: a contextCeiling it may declare is unread`
+    });
+  }
+  for (const f of manifests) {
     const text = readText(f.path);
     if (text === null) {
       census.unreadable.push({ anchor: f.rel, reason: `${f.rel} is not readable as text` });
@@ -6722,14 +6842,21 @@ var c24AcceptanceAtDispatch = {
         `C24 positive control FAILED: ${JSON.stringify(ctl)} \u2014 the dispatch matcher cannot tell an instrument job from another, verdict untrustworthy`
       );
     }
-    const docs = diskText(tree, (_name, rel) => DISPATCH_PATH_RE.test(rel)).filter(
-      (d) => INSTRUMENT_RE.test(d.text) && ACTION_RE.test(d.text)
+    const candidates = diskText(tree, (_name, rel) => DISPATCH_PATH_RE.test(rel));
+    const docs = candidates.filter((d) => INSTRUMENT_RE.test(d.text) && ACTION_RE.test(d.text));
+    const unreadDocs = refusedAsUnreadable(
+      candidates.refused,
+      "it may be an instrument dispatch document, so it is unread"
     );
     if (docs.length === 0) {
-      return absentResult(
+      return settle(
         this.id,
-        "-",
-        "no instrument dispatch document (task / dispatch / brief / issue template naming a detector or conformance instrument and an action on it) in the tree \u2014 C-24 static half n/a; the gate half is the delivery gate's (positive control OK)"
+        absentResult(
+          this.id,
+          "-",
+          "no instrument dispatch document (task / dispatch / brief / issue template naming a detector or conformance instrument and an action on it) in the tree \u2014 C-24 static half n/a; the gate half is the delivery gate's (positive control OK)"
+        ),
+        unreadDocs
       );
     }
     const lacking = docs.filter((d) => !hasAcceptanceBlock(d.text));
@@ -7761,7 +7888,10 @@ var c29ServedSkills = {
     const missing = [...methods].filter(([, a]) => a.length === 0).map(([m]) => m);
     const reds = [];
     const helpers = helperImports(tree, /skill/i);
-    const unreadable = [...surface.unreadable];
+    const unreadable = [
+      ...surface.unreadable,
+      ...refusedAsUnreadable(skillFiles.refused, "its name was not compared to its directory")
+    ];
     if (missing.length > 0) {
       if (helpers.length > 0) {
         unreadable.push({
@@ -8180,14 +8310,18 @@ var c31PluginInstallable = {
       tree,
       (_n, rel) => rel === ".claude-plugin/plugin.json" || rel.endsWith("/.claude-plugin/plugin.json")
     );
+    const refusedManifests = refusedAsUnreadable(
+      manifests.refused,
+      "this plugin folder's manifest is unread, so it was not judged"
+    );
     if (manifests.length === 0) {
       return couldNotJudge(
         this.id,
-        tree.root,
-        `no plugin folder could be located under ${tree.root} (a directory holding .claude-plugin/plugin.json) \u2014 whether the object installs as a Claude plugin is unjudged (C-31)`
+        refusedManifests[0]?.anchor ?? tree.root,
+        refusedManifests.length > 0 ? `${refusedManifests.map((u) => u.reason).join("; ")} \u2014 whether the object installs as a Claude plugin is unjudged (C-31)` : `no plugin folder could be located under ${tree.root} (a directory holding .claude-plugin/plugin.json) \u2014 whether the object installs as a Claude plugin is unjudged (C-31)`
       );
     }
-    const out = { reds: [], unreadable: [] };
+    const out = { reds: [], unreadable: [...refusedManifests] };
     for (const m of manifests) judgeFolder(tree, dirname4(dirname4(m.path)), m.path, out);
     const anchor = manifests[0].rel;
     if (out.reds.length > 0) {
@@ -8657,9 +8791,10 @@ function sdkV2Range(tree) {
   }
   return null;
 }
+var isManifest = (n) => n === "mcp.json" || n === "mcp-server.json";
 function triggers(tree) {
   const out = [];
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  for (const f of findDiskFiles(tree, isManifest)) {
     const j = readJsonRecord(f.path);
     if (!j || isRecord(j.mcpServers)) continue;
     const v = j.minProtocolVersion;
@@ -8732,12 +8867,19 @@ var d5 = {
         verdict: `no server/discover handler (grep=0, positive-control OK) although this server targets ${TARGET}: ${why.join("; ")} -> respond to server/discover with supportedVersions and capabilities, and announce the same capability set as initialize (S-4)`
       };
     }
-    return {
-      id: this.id,
-      anchor: "-",
-      state: "absent",
-      verdict: "no server/discover handler (grep=0, positive-control OK); no closed trigger found (no manifest minProtocolVersion >= 2026-07-28, no events capability, no host extension) -> S-4 does not oblige; add via protocol-kit when targeting 2026-07-28"
-    };
+    return settle(
+      this.id,
+      {
+        id: this.id,
+        anchor: "-",
+        state: "absent",
+        verdict: "no server/discover handler (grep=0, positive-control OK); no closed trigger found (no manifest minProtocolVersion >= 2026-07-28, no events capability, no host extension) -> S-4 does not oblige; add via protocol-kit when targeting 2026-07-28"
+      },
+      refusedAsUnreadable(
+        findDiskFiles(tree, isManifest).refused,
+        "its minProtocolVersion (the trigger of S-4) is unread"
+      )
+    );
   }
 };
 
@@ -13247,15 +13389,22 @@ var e11SurfacesDerived = {
       );
     }
     const manifests = findDiskFiles(tree, (n) => n === "extension.json");
+    const unreadable = refusedAsUnreadable(
+      manifests.refused,
+      "its surfaces are unread"
+    );
     if (manifests.length === 0) {
-      return {
-        id: this.id,
-        anchor: "-",
-        state: "absent",
-        verdict: "no extension.json in the tree: the object is not an extension; E-11 n/a"
-      };
+      return settle(
+        this.id,
+        {
+          id: this.id,
+          anchor: "-",
+          state: "absent",
+          verdict: "no extension.json in the tree: the object is not an extension; E-11 n/a"
+        },
+        unreadable
+      );
     }
-    const unreadable = [];
     const reds = [];
     let judged = 0;
     for (const m of manifests) {
@@ -13343,9 +13492,10 @@ var e11SurfacesDerived = {
 
 // src/detectors/e12-host-capability-placement.ts
 var TARGET2 = "2026-07-28";
+var isManifest2 = (n) => n === "mcp.json" || n === "mcp-server.json";
 function targets2026(tree) {
   if (codeSites(tree, /["'`]2026-07-28["'`]/g).length > 0) return true;
-  for (const f of findDiskFiles(tree, (n) => n === "mcp.json" || n === "mcp-server.json")) {
+  for (const f of findDiskFiles(tree, isManifest2)) {
     const j = readJsonRecord(f.path);
     if (!j || isRecord(j.mcpServers)) continue;
     if (typeof j.minProtocolVersion === "string" && j.minProtocolVersion >= TARGET2) return true;
@@ -13402,10 +13552,17 @@ var e12HostCapabilityPlacement = {
       );
     }
     if (targetUnknown) {
-      return couldNotJudge(
+      return settle(
         this.id,
-        r.caps[0].anchor,
-        `${experimentalOnly.join(", ")} is announced only under capabilities.experimental, and nothing in this tree states that the server targets ${TARGET2} (no "${TARGET2}" literal, no manifest minProtocolVersion) \u2014 the placement rule applies only to such a server (E-12)`
+        couldNotJudge(
+          this.id,
+          r.caps[0].anchor,
+          `${experimentalOnly.join(", ")} is announced only under capabilities.experimental, and nothing in this tree states that the server targets ${TARGET2} (no "${TARGET2}" literal, no manifest minProtocolVersion) \u2014 the placement rule applies only to such a server (E-12)`
+        ),
+        refusedAsUnreadable(
+          findDiskFiles(tree, isManifest2).refused,
+          "its minProtocolVersion (the server's target) is unread"
+        )
       );
     }
     return settle(
@@ -14559,6 +14716,10 @@ var s16LocalFootprint = {
     }
     const manifests = diskText(tree, (name) => MANIFESTS.has(name));
     const documented = manifests.some((m) => documentsFootprint(m.text));
+    const unreadManifests = refusedAsUnreadable(
+      manifests.refused,
+      "it may document the file footprint, so it is unread"
+    );
     const sensitive = productHits(tree, SENSITIVE_RE);
     const listens = productHits(tree, LISTEN_RE);
     const transports = productHits(tree, TRANSPORT_RE);
@@ -14576,7 +14737,10 @@ var s16LocalFootprint = {
       );
     }
     const reds = [];
-    if (!documented) {
+    let footprintUnjudged = false;
+    if (!documented && unreadManifests.length > 0) {
+      footprintUnjudged = sensitive.length > 0 || homeReaders.length > 0;
+    } else if (!documented) {
       for (const h of sensitive) {
         reds.push(
           `${h.anchor} names a sensitive path outside any declared object (${h.text.trim().slice(0, 60)}): a local server reads nothing outside its object unless the tool requires it and the manifest documents it`
@@ -14605,6 +14769,13 @@ var s16LocalFootprint = {
         `${reds.join("; ")} (S-16, positive-control OK)`
       );
     }
+    if (footprintUnjudged) {
+      return couldNotJudge(
+        this.id,
+        unreadManifests[0].anchor,
+        `${unreadManifests.map((u) => u.reason).join("; ")}; ${sensitive.length} sensitive path(s) and ${homeReaders.length} home-directory read(s) are in the tree, and whether the manifest documents their footprint is unread (S-16)`
+      );
+    }
     const stdio = transports.some((t) => /StdioServerTransport/.test(t.text));
     const http = transports.some((t) => !/StdioServerTransport/.test(t.text)) || listens.length > 0;
     const socketOnly = listens.length > 0 && listens.every((h) => SOCKET_RE.test(h.text.match(LISTEN_RE)?.[1] ?? ""));
@@ -16383,6 +16554,17 @@ var s34AccessRecheck = {
         );
       }
     }
+    if (manifests.refused.length > 0) {
+      const named = refusedAsUnreadable(
+        manifests.refused,
+        "its events.accessRecheckSeconds is unread"
+      );
+      return couldNotJudge(
+        this.id,
+        named[0].anchor,
+        `${named.map((u) => u.reason).join("; ")}${seen.length > 0 ? ` (the readable manifests say: ${seen.join("; ")})` : ""}; the recheck window cannot be judged absent or non-positive over a manifest that was not read (S-34)`
+      );
+    }
     const where = manifests[0]?.rel ?? surface.declared.anchor;
     return {
       id: this.id,
@@ -16969,6 +17151,7 @@ child.stdout.on("data", (d) => {
   while ((i = buf.indexOf("\n")) >= 0) {
     const line = buf.slice(0, i); buf = buf.slice(i + 1);
     if (!line.trim()) continue;
+    // (a) Not a filesystem read: an in-memory parse of one stdout line. A non-JSON line is legitimately not a JSON-RPC answer (a server may log to stdout); the answers it never gave surface as no-answer outcomes / the 5 s probe deadline, never as a silent pass.
     let msg; try { msg = JSON.parse(line); } catch { continue; }
     // A request or notification FROM the server carries a method: it is not an answer.
     if (msg.method !== undefined) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/mcp-doctor",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Static MCP conformance checker: audits an MCP server source tree against the MCP 2026-07-28 standard and emits a conformance-diff table (file:line | present | absent | non-conforming | verdict).",
   "type": "module",
   "main": "./dist/doctor.js",