docs(status): rc6, and the two defects in the diagnostic we were about to use (#119)

Records what Mark's second email establishes, the correction to my own
report that #111 was unmerged (it was not — stale origin/main), and the
part that survives it: rc5 was built four hours before that merge, so the
shim has still reached nobody.

Also records the #113 decision reversing half of #112, and that rc6 is
built but deliberately not published to R2.

Author: ifahimreza

STATUS.md

@@ -1,4 +1,19 @@
 ## Last session
+2026-08-18 (**Mark's second email read against the tree → rc6 cut with the fix rc5 missed, plus two defects found in the diagnostic we were about to point him at**) — Fahim forwarded Mark's clarification. Three PRs merged ([#116](https://github.com/plugpressco/saddle/pull/116), [#117](https://github.com/plugpressco/saddle/pull/117), [#118](https://github.com/plugpressco/saddle/pull/118)), issues #113 and #115 filed and closed, **596 tests** (was 594), 0 lint errors. **`dist/saddle-1.0.0-rc6{,-selfhosted}.zip` built and verified; NOT published to R2 and not yet sent to Mark.**
+
+**What the email actually establishes.** ChatGPT never touched WordPress. It planned and wrote prompts; **Claude Desktop did every WordPress action through Saddle**, creating two Divi 5 posts out of Text and Code modules that stay editable in the Visual Builder, on staging and then live, with correct post ids, statuses and scheduled dates read back. First customer-side proof of the Divi path end to end, and it independently clears the endpoint, OAuth, tiers, the write gate and Pro's Divi layer. [#108](https://github.com/plugpressco/saddle/pull/108) is confirmed working in the field: his connection reads *Verified / Reading & writing* rather than pinned to read. The open bug is one narrow thing — ChatGPT completes setup and gets **0 callable tools**.
+
+**The leading cause was already fixed, and rc5 does not contain it.** [#111](https://github.com/plugpressco/saddle/issues/111)/[#112](https://github.com/plugpressco/saddle/pull/112) — `Saddle_MCP_Compat`, the shim that exists so ChatGPT can discover tools, shipped in no channel. **I first reported it as unmerged; that was wrong** — a stale `origin/main` ref, unfetched. It merged 2026-08-17 18:30 UTC. What is true is the part that matters: **rc5 was built at 14:14 UTC, four hours earlier**, verified in the artifact (`dist/saddle-1.0.0-rc5.zip` carries no `class-saddle-mcp-compat.php`). So the fix has still reached nobody — twice now, first by exclusion and then by timing.
+
+**Why it produces exactly Mark's symptom.** `Saddle::adapter_available()` tests for `\WP\MCP\Core\McpAdapter` — not for our bundled copy — so a site running the **official MCP Adapter plugin** takes the adapter path on any channel, the shim isn't there, and the adapter's non-spec `Mcp-Session-Id` requirement refuses `tools/list` before the handler. mcp-remote echoes the header so Claude Desktop is unaffected; ChatGPT does not. **Unverified link: whether staging.kesuk.net has that plugin.** The Client traffic report's `Transport:` line answers it in one paste.
+
+**Two defects found in that diagnostic while checking it was safe to point him at.** (1) [#115](https://github.com/plugpressco/saddle/issues/115) — `record_health()` had one call site, on the adapter path, so on every zip we ship the card opened with *"No app has connected yet, so there's nothing to report"* regardless of reality. It is the first line of the one screen support points at, and it reads as "this card is broken", so the Record button underneath never gets pressed. Now recorded from `list_tools()`, counted **before** the tier filter (reading it off the filtered payload would report a read-tier site as having *lost* tools it is merely not offering — there is a test for that), and both copy branches reworded. (2) The `version` grunt task wrote four of the five places the version lives and skipped `package-lock.json` entirely. Fixed structurally, not by regex — every dependency in a lockfile has its own `"version"` field, and a global substitution rewrites them all.
+
+**One decision taken, and it reverses half of #112.** #112 also re-added `includes/lib/**` to the self-hosted channel, on the strength of a comment written before `Saddle_MCP`'s transport was hardened in #97 *because* ".org has no adapter". Reverted in [#117](https://github.com/plugpressco/saddle/pull/117), split to [#113](https://github.com/plugpressco/saddle/issues/113) with the case for it recorded. The invariant kept: **self-hosted = the .org artifact plus the updater, exactly one file** (120 vs 121, verified in both zips), so a tester is testing what .org ships.
+
+**rc6 artifacts, verified in the zip rather than the tree:** shim present on both channels, `lib/wp-mcp` 0 files on both, updater absent from `.org` and present in `-selfhosted`, no `tests/`/`dist/`/`*.md`, no `class-saddle-ecosystem.php`, all five version sites agreeing with `Stable tag` correctly held at 1.0.0, `revendor-wp-mcp.php --check` clean. sha256 `4ca7c19b…` (.org) / `02359da9…` (selfhosted). **Not run:** Plugin Check against the built zip.
+
+## Previous session
 2026-08-17 (**an OAuth connection could be pinned to `read` forever — root-caused, fixed, and the repair path built**) — Fahim's report: Permissions set to "Managing the site", ChatGPT reporting `read` access and **83 of 160** tools, every Waggle write tool missing, and "edit operation fails" on `waggle-update-seo-meta`. Refreshing the connector changed nothing. **It was ours, on both sides.** → [#107](https://github.com/plugpressco/saddle/issues/107) / PR [#108](https://github.com/plugpressco/saddle/pull/108), and waggle [#181](https://github.com/plugpressco/waggle/issues/181) / PR [#182](https://github.com/plugpressco/waggle/pull/182). 594 tests (was 577), 0 lint errors. **Both PRs open, not merged** — over the 400-line ask-first threshold and OAuth code.
 
 **The chain, in order.** `get_tier()` is `min(site tier, credential ceiling)`; site tier was `admin`, ceiling was `read`, so `filter_adapter_tools_list()` dropped every ability above `read` at dispatch. The ceiling was `read` because **three** places named `saddle:read` as a constant, and the live one is the least obvious: `normalize_scope()` fell back to `DEFAULT_SCOPE` when the client sent no scope — and **ChatGPT sends none at all**, it registers via DCR and starts the flow with no `scope` parameter ([confirmed in OpenAI's own developer forum](https://community.openai.com/t/how-are-the-scopes-that-the-chatgpt-connector-requests-when-authorizing-the-mcp-server-determined/1363723)). The 401 challenge advertised `saddle:read` regardless of the site's level, and the consent screen had a branch for "asked for more than the site allows" and none for "asked for less". So every ChatGPT grant landed on read, permanently, and **reconnecting produced an identical grant** — the one remedy the UI suggested was the one that could not work.
@@ -278,7 +293,10 @@ Earlier 2026-07-12 — **Audit-backlog execution (P0–P4)**. Cleared the audit
 - Earlier same day: the Closed-Loop Quality Engine free half (epic #22, PRs #28–#32, 300 green) — see git history.
 
 ## Next up
-- **Mark Roach — reply drafted 2026-08-17, awaiting Fahim's send.** He escalated: two weeks, no working connection, and his complaint is explicitly about *communication* rather than bugs. **The uncomfortable finding: his bug was fixed on 08-16 and the build never reached him** — rc4 carried the handshake fix, but the update channel served rc3 until rc5 went out today, and this very line sat here saying "reply with a build to test" for a day and a half. Draft is in `~/.claude/plans/warm-juggling-babbage.md`: owns the delivery failure, answers his five questions, attaches `saddle-1.0.0-rc5-selfhosted.zip`, moves him to Fahim's personal address (support@plugpress.co queues), offers a refund with no strings, and asks him to rotate the plaintext mrr.org.uk credentials. **Open item the reply promises within 24h: settle whether OpenAI really gates write-capable connectors to Business/Enterprise/Edu** — their own docs contradict the secondary sources, and Mark's workspace is the live test case. Ask him the plan; record the answer here.
+- **Mark Roach — send rc6 and ask for ONE thing: the Client traffic report.** Saddle → Connections → Connection details & health → Client traffic → **Record the next hour** → reconnect in ChatGPT → **Copy report**. Its `Transport:` line decides everything: `MCP Adapter x.y.z (another plugin)` means #111 was his bug and rc6 fixes it; `Saddle built-in JSON-RPC` means look at the rows instead — no rows at all = the requests never reached WordPress (20i StackProtect / StackCache, or ChatGPT failing before it calls); `status:401` = the bearer isn't resolving; `status:200 tools:0` = our filter is withholding everything; `status:200 tools:36` = **Saddle answered correctly and ChatGPT dropped the list**, the [documented](https://community.openai.com/t/mcp-connected-but-not-invokable/1384847) connector bug. Tell him plainly that **0 tools is not the Business/Enterprise write gate** — a read-gated connector still lists read tools. Attach `dist/saddle-1.0.0-rc6-selfhosted.zip` (the `.org` zip has no updater, so he'd be hand-installing forever). **Still ask him to rotate the mrr.org.uk credentials he emailed in plaintext.**
+- **rc6 is built but NOT published.** `./scripts/release.sh saddle 1.0.0-rc6 dist/saddle-1.0.0-rc6-selfhosted.zip <manifest>` pushes it to R2, which changes what every self-hosted install downloads — Fahim's call, deliberately not taken. Note rc5 was never published either, which is why the update channel is still behind.
+- **The premise to settle before believing any of the above.** The #111 chain requires the official **MCP Adapter plugin** to be active on staging.kesuk.net. Nothing in hand confirms it. If the report says `Saddle built-in JSON-RPC`, the diagnosis is wrong and the rows are the evidence to reason from instead — don't retrofit.
+- ~~**Mark Roach — reply drafted 2026-08-17, awaiting Fahim's send.**~~ *(superseded; the delivery-failure framing and the five answers still stand)* He escalated: two weeks, no working connection, and his complaint is explicitly about *communication* rather than bugs. **The uncomfortable finding: his bug was fixed on 08-16 and the build never reached him** — rc4 carried the handshake fix, but the update channel served rc3 until rc5 went out today, and this very line sat here saying "reply with a build to test" for a day and a half. Draft is in `~/.claude/plans/warm-juggling-babbage.md`: owns the delivery failure, answers his five questions, attaches `saddle-1.0.0-rc5-selfhosted.zip`, moves him to Fahim's personal address (support@plugpress.co queues), offers a refund with no strings, and asks him to rotate the plaintext mrr.org.uk credentials. **Open item the reply promises within 24h: settle whether OpenAI really gates write-capable connectors to Business/Enterprise/Edu** — their own docs contradict the secondary sources, and Mark's workspace is the live test case. Ask him the plan; record the answer here.
 - ~~**Reply to Mark Roach with a build to test.**~~ *(superseded by the line above; kept for the diagnostics)* The handshake fix is in `main` and unreleased. Two things to tell him beyond "try this": at the read tier he is now offered 36 tools rather than 66 (the new filter working as designed — and relevant because **ChatGPT restricts write-capable connectors to Business/Enterprise/Edu**, so on Plus or Pro his connector is read-only whatever scope he approved); and if it still shows nothing, **Connections → Connection details & health → Client traffic** is the next diagnostic. A `tools/list` row with status 200 and a non-zero count means Saddle is conformant and the tools are being dropped inside ChatGPT — a [documented](https://community.openai.com/t/mcp-connected-but-not-invokable/1384847) connector bug. **Still ask him to rotate the mrr.org.uk credentials he emailed in plaintext.**
 - **Migrate saddle-pro and mailyard onto `saddle_context_sections`.** Free's half shipped in #102 and both still append through the old string filter, so Pro's `##` heading and Mailyard's floating "For email delivery problems:" sentence are still in the live context. Pro's tree currently has uncommitted release prep in it (a 1.4.0 → 1.4.1 bump), which is why it was left alone. Nothing breaks meanwhile — the compat path is tested.
 - **The three surviving branches are all superseded or dead — decide and delete.** `feat/admin-header` (9 commits) and `feat/ui-plugpress-ui-v0.6.0` (a strict subset of it) targeted `@plugpress/ui` v0.8.2; `main` is on **v0.11.3**, TopBar and `Saddle_Log::record_action()` are both there, and every file they add exists on main in restructured form. `feat/freemius-parent` puts Freemius in FREE, which contradicts both CLAUDE.md ("no licensing or upsell in free") and the decision that free ships on WP.org with no Freemius.