HOLD: simplify unpublished Hosted Doctor evidence follow-ups

.github/workflows/test.yml

@@ -9,3 +9,4 @@ jobs:
         with:
           node-version: 24
       - run: node --test tests/*.test.mjs
+      - run: node scripts/sync-mcp-helpers.mjs --check

README.md

@@ -63,9 +63,10 @@ Codex's skill picker (`$chatcut:chatcut-mcp-doctor` for the Git plugin,
 `$chatcut-desktop:chatcut-mcp-doctor` for the existing store identity), or
 `/chatcut:chatcut-mcp-doctor` in Claude Code. It runs locally even when ChatCut
 MCP cannot connect and prepares a report, explanation and private feedback draft.
-Doctor is included from Codex 1.10.22 / Claude Code plugin 1.10.24; check the
-installed version and skill catalog when using an older package. Local diagnosis
-does not require ChatCut authentication.
+Doctor is an unpublished candidate on this branch. Its manifest versions are
+not released minimum versions, and the separate collection-only packages do
+not include this entry. Check actual installed contents and the skill catalog.
+Local diagnosis does not require ChatCut authentication.
 See [Doctor discovery/fallback](codex/skills/chatcut-mcp-doctor/references/discovery.md).
 The host's own `/doctor` command is separate.
 

claude/skills/chatcut-mcp-doctor/SKILL.md

@@ -1,49 +1,32 @@
 ---
 name: chatcut-mcp-doctor
-description: Diagnose hosted ChatCut MCP connection, startup, authentication or tool-call failures from a working Codex or Claude Code agent, even when ChatCut tools cannot connect. Produce evidence-based findings, repair guidance, rechecks and local feedback materials. Use for ChatCut Doctor or MCP连接错误; not for Desktop ACP or unrelated video editing.
+description: Investigate hosted ChatCut MCP connection, authentication and tool errors using the original error, existing evidence and a same-host safe recheck. Use when ChatCut will not connect; not Desktop MCP.
 ---
 
-# ChatCut MCP Doctor
+# ChatCut MCP evidence
 
-This Skill runs with local file/shell tools and Node 18+, independently of ChatCut MCP. Do not wait for ChatCut tools, a project, login, or the basics Skill to load. Tell the user that you are collecting connection diagnostics and whether the report will be sent. Honor local-only requests and existing execution/network permissions.
+Help the user understand and resolve the actual failure. This unpublished candidate runs with local file/shell tools even if hosted MCP is unavailable. Preserve the visible original error before a retry or change; do not read credentials or whole conversations.
 
-## Start here
+Use the existing report when following up. Refer to its explicit path and diagnostic ID; do not create another baseline just because the Skill was invoked again. There is no active-case index or time window. A new report is useful only when collecting new evidence for a distinct observation.
 
-- In Codex, select **ChatCut MCP Doctor** from the skill picker. The Git plugin entry is `$chatcut:chatcut-mcp-doctor`; the existing store identity uses `$chatcut-desktop:chatcut-mcp-doctor`; a standalone project/personal copy is `$chatcut-mcp-doctor`. Use the exact installed catalog entry. Natural language: “Diagnose my ChatCut MCP connection with ChatCut MCP Doctor.”
-- In Claude Code with the ChatCut plugin, invoke `/chatcut:chatcut-mcp-doctor`. A separately installed project/personal copy uses `/chatcut-mcp-doctor`.
-- `/doctor` and `codex doctor` belong to the host; this Skill does not replace them. If the entry is absent or the plugin is old, read [discovery and fallback](references/discovery.md). A browser-only host without local execution cannot run this collector; retain the error and explain that boundary.
-
-## Preserve, collect, explain
-
-Preserve the already visible original error before retries, reconnects or changes. Read [connection diagnostics](references/connection-diagnostics.md) for the dedicated failure/snapshot schema, bounded logs and collector options. Unknown times, IDs and stages stay unknown. Do not read credentials, auth.json, full configuration files or conversation transcripts.
-
-Resolve paths from **this Skill's directory**, then invoke standalone quoted Node commands. The agent creates the files; the user should not have to fill JSON. Capture observed host registration/session facts; static CLI configuration cannot establish current tools or authentication. For a registration lookup, record `stage: host_registration`, `operation: lookup_registered_server`, `source: cli_configuration` (or `host_settings`), its actual `outcome`, exact response/error and actual observation time or null. Add `lookupResult: not_found` **only** when a completed host query explicitly reports no named entry in the selected scope, or a successful complete scoped inventory establishes absence. A nonzero exit, EACCES, parse error, missing CLI, or empty tool list cannot establish absence; omit `lookupResult` or use `unavailable` and preserve that error. `found` records an explicitly present entry. These remain agent-supplied facts; the helper does not independently verify a missing registration. A failed original tools/call may use `stage: tools_call` with its actual source.
+When collection is needed, save the exposed error alone and run the local helper, resolving paths from this Skill:
 
 ```text
-node "<this-skill>/scripts/doctor.mjs" --host codex --server-url <actual-registered-url> --host-snapshot <new.mcp-snapshot.json> --failure-record <new.mcp-failure.json> --output <new.mcp-report.json>
+node "<this-skill>/scripts/capture.mjs" --host <codex|claude> --original-error "<error-only.mcp-error.txt>"
 ```
 
-Use `--host claude` for Claude Code. Omit unavailable optional inputs. If there is no registered URL, omit it; do not silently choose production. `--offline` keeps the registered URL as evidence but sends **no requests**, including upload. Otherwise the collector makes bounded anonymous entry/metadata checks and optional wire checks; an initial anonymous 401 is expected. Use `--upload` for the redacted report when transfer is authorized, after briefly explaining it. An intentionally disabled server is preserved without requests.
-
-The command writes the existing schema-2 report plus `.diagnosis.json`, `.summary.md` and `.issue-draft.md` sidecars. Read the findings and actual gaps before answering; do not merely echo a category. Findings identify observed boundaries, not root causes. Distinguish original failure, host evidence and later probes. Missing/truncated/denied logs remain gaps. A healthy later probe does not establish recovery. Proxy presence, busy/300-second timeouts and generic transport errors do not justify blaming security software, clearing locks/credentials, restarting or changing timeouts/environments.
-
-Wire failures/incomplete captures are later **direct-route** checks even if fetch metadata succeeds. Bounded native ERROR records and App `status=failed` notices are visible as unassociated host evidence; they do not fill a missing original error/time/request ID. Ordinary App starting/ready notices do not demonstrate failure. Local summaries show credential-redacted error excerpts; issue drafts keep structured states and evidence pointers without copying native log excerpts.
-
-## Repair and recheck
-
-For an observed missing registration or a normal sign-in requirement, read [repair and recheck](references/repair-and-recheck.md). Apply only the minimal change within the user's authorization and actual host/scope. Keep the prior state and rollback. Other findings need evidence-led investigation; this version has no automatic credential/network repair.
+A structured retained original may instead use `--failure-record <file.mcp-failure.json>`. Add the known operation and selected URL if exposed; omit unknowns. Default capture is offline. The receipt gives the saved report and SHA. Optional `--native-lookup` runs a bounded native registration query that may connect; obtain permission for that check. Configuration presence does not establish active-session tools, authentication or recovery. Missing project config is not proof of absence in other scopes. [Collection details](references/connection-diagnostics.md).
 
-Verify the affected boundary in the **same host and scope** after a change. Registration lookup success proves registration only. Auth success requires the host's authenticated state. Tool recovery requires a safe read-only call such as `list_projects` actually succeeding. If the original operation mutates state, costs credits, or cannot be safely repeated, do not replay it; say that its recovery remains unverified. Record the actual action, time/source and verification result in the summary and draft; never label an unperformed repair as tried. Keep the report's original failure immutable and its collector `recoveryVerified:false`; agent recheck results are separate evidence.
+Use the facts to choose the smallest next check. There is no mandatory generated diagnosis or wording. Keep the original failure, later independent probes and actual native tool results distinct. Unknown source bytes, time, IDs and root causes stay unknown. [Existing repair guidance](references/repair-and-recheck.md) covers a demonstrated missing manual Hosted registration; do not duplicate plugin-managed servers, change environments or credentials, or repair Desktop with this Hosted recipe. Preserve the actual action and rollback in a separate note.
 
-## Feedback without starting over
+After a justified authorized change, use the original Codex or Claude host, configuration scope and target service/project for an actual safe tool call. Inspect its current schema. `list_projects` checks a Hosted project listing, not access to an affected project; an empty list does not prove that project's recovery or account authentication. Configuration queries, tool discovery and independent HTTP probes are not tool rechecks. Do not replay mutations or generation calls.
 
-Return the observed finding, justified next action, diagnostic ID, report/summary locations and remaining gap in the user's language. An unresolved case should include the ready-to-review issue draft. The local JSON retains full credential-redacted evidence; the draft excludes log dumps and local IDs, but still needs review for personal/project data before sharing.
+Save only the actually exposed tool result in a separate file, then record it against the original report:
 
 ```text
-node "<this-skill>/scripts/doctor.mjs" --report <existing.mcp-report.json>
-node "<this-skill>/scripts/doctor.mjs" --upload-report <existing.mcp-report.json>
+node "<this-skill>/scripts/record-recheck.mjs" --report "<original-report>" --host <codex|claude> --result "<actual-result-file>" --operation <actual-tool> --outcome <success|failed> --server-url <actual-service> --config-scope "<actual-configuration-scope>"
 ```
 
-`--report` rebuilds sidecars offline without recollecting. It overwrites derived sidecars, so save any agent-written repair notes separately first. Use `--upload-report` only for an authorized first transfer or a single requested retry after failure; it reuses the original diagnostic ID without new probes, keeps the original report unchanged, and writes a separate upload receipt. Do not repeatedly recollect or resend an acknowledged report. `ingest_accepted` is not verified final storage or an opened support ticket.
+Add known `--project-id`, local `--conversation-id`, `--call-id`, `--observed-at`; omit unknown facts. Never copy an MCP session credential as a conversation ID. Choose the safe operation from the current tool schema; the recorder does not execute tools or impose a fixed tool list. A native MCP content-only result is usable as exposed; do not fabricate projects[] or structuredContent to satisfy a result format. If no actual tool result is exposed, retain that gap. Each invocation saves another observation. It is Agent supplied, not independent proof of the original attempt or recovery. A new host/session is a separate boundary to disclose, not automatic continuation of the old one. No actual result or no saved observation means recheck incomplete.
 
-Use [ChatCut contact](https://chatcut.io/contact) for private support. The draft names no public issue repository because that destination is undecided. Do not open an issue, publish evidence, or message anyone without authorization. Root-cause rules and prevalence based on natural incidents remain future work; controlled tests are not user incidents.
+Explain the symptom, evidence, actual action, actual recheck and remaining unknowns in the user's language. Deliver the existing local report, repair note and recheck files even when upload is unavailable. Optional `doctor.mjs --report <report>` derives feedback from the unchanged report; it does not recollect. Authorized transfer uses `doctor.mjs --upload-report <report>` and a separate SHA-bound receipt. Do not resend acknowledged or uncertain delivery. Acceptance is not complete storage; failed upload retains the reason and local files. No ticket, publishing or messaging without authorization.

claude/skills/chatcut-mcp-doctor/references/advanced-collection.md

@@ -0,0 +1,13 @@
+# Optional collection and delivery
+
+Use the existing report when following up. Collection is not a prerequisite for reasoning from evidence that is already available.
+
+For explicit new collection, the canonical helper is `scripts/mcp-doctor.mjs`. Run `--help` for the options in the installed copy. It supports error-only original inputs, bounded native logs, projected host snapshots, offline collection and independent anonymous metadata/wire checks. The latter are later probes, never the original failed request. Keep the selected endpoint; never switch beta/dev to production to obtain success.
+
+`capture.mjs --host codex|claude` is an offline convenience that can project the current project registration without retaining credential fields. Original error inputs are explicit, never selected from old files automatically. `--native-lookup` opts into a bounded host CLI query, which may perform health checks. Its receipt identifies the new report; it does not choose which incident should be rechecked.
+
+`doctor.mjs --report <existing-report>` optionally derives diagnostic/summary/private draft files without changing the original. Agent repair notes and rechecks are separate files and are not overwritten by rebuilding those derived files.
+
+`doctor.mjs --upload-report <existing-report>` is the Doctor's saved-report transfer entry. It acquires an exclusive local owner, checks the SHA-bound receipt inside that ownership, and sends no new probes. An interrupted transfer retains the owner/uncertain receipt for review. An acknowledged or uncertain transfer cannot be automatically repeated. A failed transfer keeps its original cause and local evidence. An ACK still requires independent fragment reassembly and SHA verification before claiming complete storage. Repair notes and rechecks are local delivery artifacts, not silently inserted into the original upload.
+
+The collector implementation is authored in Codex basics. Run `node scripts/sync-mcp-helpers.mjs` after changing it; Claude basics and both self-contained Doctor packages are generated copies. `--check` rejects drift in CI. Doctor publication remains separate from collection-only release.