staysfixed 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -6,6 +6,91 @@ numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.15.0] — 2026-09-02
+
+### A guard can say it cannot be answered here
+
+Fifty guards were written for a real product in one night and put through a real run. Several
+failed on that machine for reasons that had nothing to do with the product: one wanted a paired
+second machine, one an Android phone, several a session in a state nothing had put it in.
+Nothing was broken. They were being asked somewhere that could not answer them.
+
+Until now such a guard had two ways out and both were wrong. **Passing is a lie** — it reports
+that a bug did not come back, having looked for nothing, which is the false all-clear this whole
+tool exists to prevent, wearing the friendliest face it has. **Failing is a false alarm**, and
+worse than it sounds: the line printed over a failed guard is "bugs that were already fixed are
+back", so somebody hunts a regression that never happened, and after twice they stop believing
+any of them.
+
+- `cannotRunHere(why)` on a guard's run context stops it and reports **not proved**, with the
+  reason and what would let it run. Counted as neither a pass nor a failure, and excluded from
+  what the run says it looked at.
+- It **cannot** be used after an expectation has already failed. A door out of a red run is a
+  door somebody would eventually walk through.
+- It is for what the MACHINE is missing, never for what the product is doing — using it because
+  the product looks wrong would turn a real finding into silence.
+- `not proved` is its own verdict everywhere it is printed, distinct from `left out on purpose`,
+  which means somebody deliberately switched a guard off. The story of the original bug is
+  deliberately not printed underneath it: under a guard that never asked its question, "why this
+  guard exists" reads as that bug being back.
+
+On the run that prompted it, 56 guards came back 40 held, 11 not proved, 5 failed — and all five
+failures were real.
+
+
+## [0.14.0] — 2026-09-02
+
+Four defects, every one of them found by WATCHING this tool work rather than by reading it.
+The owner could not find its live window, then recorded four minutes of it running and the
+recording contained three faults nobody had noticed in a month of testing.
+
+### A system dialog can no longer stall a run in silence
+
+A real check froze for two of its four minutes behind a macOS alert — *"A keychain cannot be
+found to store 'Terminal Deck Key'"* — while a journey waited for a person who was never going
+to arrive. The run finished and reported one journey with no answer, and never said why.
+
+Every adapter here starts the product under test in a throwaway settings folder, which is
+exactly the condition that makes an application ask the operating system for something it has
+never been granted. These dialogs are a normal consequence of how this tool works, so they are
+its problem.
+
+- Modal boxes belonging to an application **this run started** are noticed, closed and reported
+  with their own words. Nothing else is touched.
+- The button pressed comes from a fixed list that decline, dismiss or close — never one that
+  grants, resets, deletes or agrees. On the alert that started this, the other button was
+  *Reset To Defaults*, on a keychain, and it was the default.
+- A dialog with nothing safe on it is **left exactly as it is** and named in the result instead.
+- `AXModal` is the test, not the subrole: an ordinary Terminal window reports the same
+  `AXDialog` subrole the real alert does, so matching on that would send this tool hunting for
+  buttons to press in somebody's actual work.
+
+### The report survives the findings
+
+When a verdict landed, everything the run had spent four minutes drawing — the walk, every
+journey and its address count, the wobble, what survived, what was not checked — vanished. The
+footer holding "Needs a person" had no cap, so seventeen findings grew it past the height of the
+panel and squeezed the body to **eighteen pixels holding 41,115** of content.
+
+The footer is capped and its list scrolls inside itself; the body keeps a floor. Held both ways
+by a guard, including against the first over-correction, which lost the same detail from the
+other end by letting the footer collapse to its label.
+
+### The live window says that it exists
+
+`--watch` is off by default, the window opens behind your work on purpose, and nothing anywhere
+ever mentioned it. Three correct decisions adding up to a feature nobody could find. `check` now
+says one line on a project that has a screen: that the window is there and how to open it, or,
+when it is open, which side of the screen it went to.
+
+### Something added is no longer described as a deletion
+
+An escalation read *"SessionBar is there now and was not before"* and then, one line below,
+*"Say whether that deletion is meant to happen."* A sealed class says what a change TOUCHES; it
+says nothing about which way it moved, and the sentence a person is asked to rule on has to
+describe what actually happened.
+
+
 ### The self-check corpus knows about the five false all-clears found on 2026-08-31
 
 Five defects were found and fixed that day, each of which could have blessed a broken build,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "staysfixed",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Prove that what already worked still works after an agent changed the code. Picture checks, guards for fixed bugs, a pre-release walkthrough, and known-good markers \u2014 as a CLI and as an MCP server.",
   "type": "module",
   "license": "MIT",

package/src/guard/api.js

@@ -32,6 +32,34 @@ export class ExpectationFailed extends Error {
   }
 }
 
+/**
+ * This guard cannot answer its question on this machine, and that is not a verdict.
+ *
+ * Added 2026-09-02, after fifty guards were written for a real product in one night and four
+ * of them failed for reasons that had nothing to do with the product: one wanted a paired
+ * machine, one an Android phone, two a session in a particular state. Nothing was broken. The
+ * guards were simply being run somewhere that could not answer them.
+ *
+ * Until this existed a guard in that position had two ways out and both were wrong. Passing is
+ * a lie — it reports that a bug did not come back, having checked nothing. Failing is a false
+ * alarm, and worse than it sounds: the line a run prints for a failed guard is "bugs that were
+ * already fixed are back", so somebody goes hunting a regression that never happened, and after
+ * it happens twice they stop believing any of them.
+ *
+ * "Not proved" is a third answer and it is the honest one. It is the same distance from a pass
+ * as "nothing was compared" is from "nothing changed", which is the distinction this whole tool
+ * is built on, and it had a hole in it exactly here.
+ */
+export class GuardCannotRunHere extends Error {
+  /** @param {string} why  Plain English: what is missing, and what would let it run. */
+  constructor(why) {
+    super(why);
+    this.name = 'GuardCannotRunHere';
+    /** @type {string} */
+    this.why = why;
+  }
+}
+
 /**
  * The run has given up on this guard, and the guard is still going.
  *
@@ -199,6 +227,21 @@ export function makeGuardApi(page, project, opts = {}) {
     page: refusable(page),
     project,
 
+    /**
+     * Say this guard cannot be answered here, and stop.
+     *
+     * Use it for what the machine is missing, never for what the product is doing: no phone
+     * attached, no second machine paired, no signed-in account to switch between. A guard that
+     * reaches for this because the product looks wrong has turned a real finding into silence.
+     *
+     * @param {string} why  What is missing, and what would let it run.
+     * @returns {never}
+     */
+    cannotRunHere(why) {
+      announce(ACTION, `cannot run here: ${short(String(why))}`)('ok');
+      throw new GuardCannotRunHere(String(why));
+    },
+
     /**
      * @param {string} to
      * @returns {Promise<void>}

package/src/guard/run.js

@@ -16,7 +16,7 @@
  * this one is not" is most of the value of running it at all.
  */
 
-import { makeGuardApi, ExpectationFailed, GuardAbandoned } from './api.js';
+import { makeGuardApi, ExpectationFailed, GuardAbandoned, GuardCannotRunHere } from './api.js';
 import { resetWindow } from '../drive/launch.js';
 import { emitEvent } from '../core/events.js';
 
@@ -29,6 +29,7 @@ const FRESH_KEY = 'fresh';
  * @typedef {import('../types.js').GuardResult & {
  *   retriedToPass?: boolean,
  *   assertedNothing?: boolean,
+ *   cannotRunHere?: boolean,
  *   timedOut?: boolean,
  *   checks?: import('../types.js').CheckStep[],
  * }} GuardRunResult
@@ -41,6 +42,9 @@ const FRESH_KEY = 'fresh';
  * @property {string} [failedAt]
  * @property {boolean} [timedOut]  The clock ran out before the guard answered. Not the same
  *                                 as the answer being no — see the note on the result below.
+ * @property {boolean} [cannotRunHere]  The guard said this machine cannot answer it and stopped.
+ *                                 `ok` is true because nothing went wrong; the flag is what stops
+ *                                 it being counted as a bug that did not come back.
  */
 
 /** @typedef {(step: import('../types.js').CheckStep) => void} StepSink */
@@ -150,12 +154,16 @@ export async function runGuards(project, app, guards, opts = {}) {
     // Its OWN questions, not the runner's. Every guard gets a "fresh start" step from this
     // file whether it asks anything or not, so counting the whole list would always find one.
     const asked = checks.filter((c) => c.key !== FRESH_KEY && !String(c.key ?? '').endsWith(`-${FRESH_KEY}`));
-    const assertedNothing = outcome.ok && asked.length === 0;
+    // A guard that stopped because this machine cannot answer it did not "check nothing" in the
+    // sense the rule below is about — it deliberately declined to claim anything, which is the
+    // opposite failure and has to be told apart from it.
+    const couldNotRun = outcome.cannotRunHere === true;
+    const assertedNothing = outcome.ok && asked.length === 0 && !couldNotRun;
 
     /** @type {GuardRunResult} */
     const result = {
       name: guard.name,
-      status: outcome.ok && !assertedNothing ? 'passed' : 'failed',
+      status: couldNotRun ? 'skipped' : outcome.ok && !assertedNothing ? 'passed' : 'failed',
       file: guard.file,
       because: guard.because,
       durationMs: Date.now() - startedAt,
@@ -163,7 +171,13 @@ export async function runGuards(project, app, guards, opts = {}) {
     };
     if (checks.length > 0) result.checks = checks;
 
-    if (assertedNothing) {
+    if (couldNotRun) {
+      // Neither a pass nor a failure, and it must not be summarised as either. The message
+      // carries what is missing so somebody reading a run can tell at a glance whether it is
+      // worth plugging a phone in, or whether this guard will never run on a build machine.
+      result.cannotRunHere = true;
+      result.message = outcome.message ?? 'This guard could not be answered on this machine.';
+    } else if (assertedNothing) {
       result.assertedNothing = true;
       // The story of the bug is not repeated in here. It travels on `because`, and the console,
       // the HTML report, the MCP answer and the live panel each print it themselves — so
@@ -368,6 +382,22 @@ async function attemptGuard(project, app, guard, baseUrl, timeoutMs, onStep) {
         message: `This should still be true, and it is not: "${error.claim}".${consoleNote(app)}`,
       };
     }
+    // NOT PROVED, which is neither of the two answers above it.
+    //
+    // The guard asked for something this machine does not have — a paired machine, a phone, a
+    // second signed-in account — and stopped. Nothing about the product was learned, so nothing
+    // about the product may be reported. Passing here would be the false all-clear this whole
+    // tool exists to prevent, and failing would say "a bug that was already fixed is back" about
+    // a bug nobody looked for.
+    if (error instanceof GuardCannotRunHere) {
+      return {
+        ok: true,
+        cannotRunHere: true,
+        message:
+          `Not proved here: ${error.why} Nothing about this bug was checked on this run, so nothing here ` +
+          `says it has not come back.`,
+      };
+    }
     // Out of time is its own answer, and it is not "no". The guard was still going when the
     // clock stopped, so all anyone knows is that nobody asked it anything it managed to
     // finish. Said in those words rather than as a returned bug.

package/src/report/console.js

@@ -127,17 +127,25 @@ function shorten(s, max) {
  *  - `unanswered` — nobody got an answer: it ran out of time, or it asserted nothing at all.
  *                   Not a pass, and not a returned bug either.
  *  - `left out`   — marked skip. Never ran.
+ *  - `not proved` — the guard asked for something this machine has not got and declined: no
+ *                   phone attached, no machine paired, no server. Distinct from `left out`,
+ *                   which is somebody deliberately switching a guard off. Somebody reading
+ *                   "left out on purpose" against a guard that WANTED to run and could not
+ *                   would go looking for the person who disabled it.
  *  - `held`       — asked, and the answer was yes.
  *
  * Anything unrecognised counts as `unanswered`, never as `held`: the one thing that must
  * never happen here is a result nobody understood being read as a clean bill of health.
  *
  * @param {import('../types.js').GuardResult} guard
- * @returns {'held'|'back'|'unanswered'|'left out'}
+ * @returns {'held'|'back'|'unanswered'|'left out'|'not proved'}
  */
 export function guardVerdict(guard) {
   const g = /** @type {any} */ (guard ?? {});
   if (g.status === 'passed') return 'held';
+  // Read before the plain 'skipped' below it: both wear that status and they mean opposite
+  // things about whether anybody wanted this guard to run.
+  if (g.cannotRunHere === true) return 'not proved';
   if (g.status === 'skipped') return 'left out';
   if (g.timedOut === true || g.assertedNothing === true) return 'unanswered';
   if (g.status === 'failed') return 'back';
@@ -162,6 +170,10 @@ function guardOutcome(g) {
       return 'still holds';
     case 'left out':
       return 'left out on purpose';
+    case 'not proved':
+      // The reason, not a fixed phrase: what is missing is the only thing worth reading here,
+      // and it is the difference between "plug a phone in" and "this will never run on CI".
+      return shorten(String(g.message || 'could not be answered on this machine'), 90);
     case 'unanswered':
       if (any.timedOut === true) return 'ran out of time — nothing was proved either way';
       if (any.assertedNothing === true) return 'checks nothing, so it is protecting nothing';
@@ -387,6 +399,16 @@ export function printGuardResult(r) {
     say(`${paint.grey(sym(mark.info))} ${paint.grey(`${name} left out on purpose`)}`);
     return;
   }
+  // NOT PROVED gets its own line, and deliberately NOT the story of the bug underneath it.
+  // The story is printed to say whether a failure matters; under a guard that never asked its
+  // question, "why this guard exists: long messages used to vanish" reads as that bug being
+  // back — which is exactly the impression this whole file exists to prevent. What belongs
+  // here is what is missing, so somebody can decide whether to go and plug it in.
+  if (verdict === 'not proved') {
+    say(`${paint.yellow(sym(mark.warn))} ${paint.yellow(`${name} ${r.message || 'could not be answered on this machine'}`)} ${time}`);
+    if (r.file) detail(`    ${shortPath(r.file)}`);
+    return;
+  }
   // A question nobody answered is not painted like a bug coming back. It still keeps the run
   // out of the green — `allClear` counts it — but the colour a person scans for should not
   // say "regression" about something the run has no opinion on.

package/src/types.js

@@ -273,6 +273,9 @@
 
 /**
  * @typedef {object} GuardApi
+ * @property {(why: string) => never} cannotRunHere               Stop, saying this machine cannot answer
+ *                                                                this guard. For what the MACHINE is
+ *                                                                missing, never for what the product does.
  * @property {PageApi} page                                       Full page control.
  * @property {(path: string) => Promise<void>} open               Shorthand for page.goto.
  * @property {(selector: string) => Promise<void>} click
@@ -506,6 +509,11 @@ export {};
  *                                          as a pass — but it is not a bug coming back, and anything
  *                                          drawing this stream has to be able to tell the two apart.
  * @property {boolean} [assertedNothing]      A guard that finished without asking a single question.
+ * @property {boolean} [cannotRunHere]       A guard that stopped because this machine cannot answer it —
+ *                                          no phone attached, no second machine paired, no second account
+ *                                          to switch between. Reported with the status 'skipped': it is
+ *                                          not a pass, because nothing about the bug was checked, and it
+ *                                          is not a failure, because nothing about the product went wrong.
  * @property {string} [thumbnail]             A small JPEG as a data: URI — an instant preview, shown
  *                                          while the real file is still being written.
  * @property {string} [shotFile]              file:// URL of the FULL-RESOLUTION picture just taken.

package/src/v2/check.js

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 import { promisify } from 'node:util';
 
 import { StaysFixedError, messageOf } from '../core/errors.js';
-import { warn, detail, shortPath } from '../core/log.js';
+import { say, warn, detail, shortPath } from '../core/log.js';
 import { findConfigFile, rootForConfig } from '../core/paths.js';
 import { sha256 } from '../core/hash.js';
 
@@ -46,6 +46,7 @@ import { whatChanged, NOT_THE_TOOLS_OWN_FOLDER } from './rank.js';
 
 import { attachWatcher, watchOptionsFrom } from './watch/index.js';
 import { guardTheScreen, describeGuard } from './watch/focus.js';
+import { watchForDialogs, describeDialogs } from './watch/dialogs.js';
 import {
   isOffScreen, moveWindowByPid, offScreen, windowBoundsByPid, withoutTakingTheScreen,
 } from './watch/window.js';
@@ -1447,7 +1448,29 @@ async function mindTheScreen(project, events) {
   // Nothing will appear and nobody asked for a window: there is no screen to look after.
   if (!wantsPanel && !couldShow) return null;
 
+  // A WINDOW NOBODY KNOWS ABOUT IS A WINDOW THAT DOES NOT EXIST.
+  //
+  // This tool draws a live view of a run — surfaces, journeys ticking, the reference it is
+  // measuring against, the findings as they land. It is off unless somebody types `--watch`,
+  // and even then it opens BEHIND their work on purpose and never comes forward again. All
+  // three of those are right on their own, and together they meant the owner ran this tool
+  // for weeks and never once saw the window, because nothing anywhere told him it was there.
+  // `staysfixed init` mentions it, which helps exactly once and only if you read the setup.
+  //
+  // So the run itself says it, once, on a project where there is something to watch.
+  if (!wantsPanel) {
+    say('There is a live window for this run — add --watch to open it beside what is being checked.');
+  }
+
   const guard = guardTheScreen();
+  // THE BOXES THIS RUN CAUSES ARE THIS RUN'S PROBLEM.
+  //
+  // Every adapter starts the thing under test in a throwaway settings folder, which is exactly
+  // the condition that makes an application ask the operating system for something it has never
+  // been granted. On 2026-09-01 that was a keychain, and the alert it raised sat on screen for
+  // two minutes of a four-minute run while a journey waited behind it for a person who was
+  // never going to arrive. Only ours, only harmless buttons, and everything seen is reported.
+  const dialogs = watchForDialogs({ elapsed: () => events.elapsed() });
   // Said under --verbose rather than always, because a person who was not interrupted
   // should not be told about the machinery that did not interrupt them. It is here at all
   // so that "the guard is running" is something anybody can see rather than take on trust.
@@ -1473,6 +1496,14 @@ async function mindTheScreen(project, events) {
         // AND --watch-front is somebody asking, in so many words, for this window in front.
         // Claiming it would have the guard undoing the flag a second after it was obeyed.
         onOpen: (browser) => {
+          // AND SAY WHERE IT WENT. The window opens behind whatever the person is doing and
+          // never asks for the screen again, which is the behaviour they asked for — but it
+          // makes a window that came up correctly look exactly like one that never came up.
+          // One line, at the moment it opens, is the whole difference between the two.
+          say(
+            `The live window is open on the ${watch.side === 'left' ? 'left' : 'right'} of your screen` +
+              (watch.foreground === true ? '.' : ", behind what you are working on — it will not come forward on its own."),
+          );
           if (browser.borrowed || watch.foreground === true) return;
           guard.claim(browser.name);
         },
@@ -1489,6 +1520,7 @@ async function mindTheScreen(project, events) {
     // Claimed the instant the process exists, before it has drawn anything. A moment
     // later and its first appearance is read as the person choosing it.
     guard.claim(app.name);
+    dialogs.claim(app.name);
     events.emit({
       type: 'note',
       at: events.elapsed(),
@@ -1506,7 +1538,14 @@ async function mindTheScreen(project, events) {
     handingBack ??= (async () => {
       stopped = true;
       stopListening();
+      // One last look before letting go: a box that came up during the final journey is the
+      // one most likely to explain a missing answer, and the periodic sweep may not have
+      // come round again before the run ended.
+      await dialogs.sweepNow().catch(() => {});
+      await dialogs.stop();
       await guard.release();
+      const said = describeDialogs(dialogs.report());
+      if (said) events.emit({ type: 'note', at: events.elapsed(), message: said });
       const line = describeGuard(guard.report());
       if (line) events.emit({ type: 'note', at: events.elapsed(), message: line });
       await Promise.allSettled(placing);

package/src/v2/escalate.js

@@ -609,6 +609,31 @@ function buildEscalations(product, record, verdict) {
   };
 }
 
+/**
+ * Which way a finding moved, read off the differences it stands for.
+ *
+ * A sealed class says what a change TOUCHES. It does not say what the change DID, and the
+ * two were treated as one thing until 2026-09-01, when a real run on a real product printed
+ * `"SessionBar" is there now and was not before` and then asked, one line below it, "Say
+ * whether that deletion is meant to happen." Nothing had been deleted. That sentence is the
+ * one a person is asked to rule on, and it described the opposite of what happened.
+ *
+ * So the direction is read rather than assumed. 'gone' only when something actually went
+ * away, 'new' only when everything is an arrival, and 'changed' for a mix or anything else —
+ * because a sentence that has to hedge is still better than one that is wrong.
+ *
+ * @param {DecidedFinding} f
+ * @returns {'gone'|'new'|'changed'}
+ */
+function whichWay(f) {
+  const kinds = (f.differences ?? []).map((d) => d && d.kind).filter(Boolean);
+  if (kinds.length === 0 && f.sample && f.sample.kind) kinds.push(f.sample.kind);
+  if (kinds.length === 0) return 'changed';
+  if (kinds.every((k) => k === 'vanished')) return 'gone';
+  if (kinds.every((k) => k === 'appeared')) return 'new';
+  return 'changed';
+}
+
 /**
  * @param {DecidedFinding} f
  * @returns {string}
@@ -619,7 +644,15 @@ function sealedTodo(f) {
   if (cls === 'guard') return 'This is a bug you already reported once, coming back. Say whether it goes back on the list, or the guard was wrong.';
   if (cls === 'money') return 'Say whether that is the amount you wanted. If it is, shipping makes it the new normal; if it is not, nothing ships.';
   if (cls === 'sign-in') return 'Say whether signing in is meant to behave like that now. Nothing ships until you do.';
-  if (cls === 'data-loss') return 'Say whether that deletion is meant to happen. This one is worth thirty seconds before anything ships.';
+  if (cls === 'data-loss') {
+    // The class means "this touches losing data". Which way it moved is a separate fact, and
+    // saying the wrong one at somebody who is about to rule on it is worse than saying less.
+    const worth = ' This one is worth thirty seconds before anything ships.';
+    const way = whichWay(f);
+    if (way === 'gone') return `Say whether that deletion is meant to happen.${worth}`;
+    if (way === 'new') return `Say whether that is meant to be there. It can lose data.${worth}`;
+    return `Say whether that change is meant to happen. It can lose data.${worth}`;
+  }
   if (cls === 'crash') return 'This has to be fixed before anything ships. Nobody needs to decide anything, but you should know it happened.';
   return `Say whether that is what you wanted${where ? `, at ${where}` : ''}. If it is, ship — shipping is what makes it the new normal.`;
 }

package/src/v2/init.js

@@ -2256,6 +2256,21 @@ function nextCommands(readiness, project) {
         ? 'The first real run. It walks everything and shows you what it sees. It cannot record what "working" means — only shipping does that.'
         : 'The first real run. Nothing here is fully set up yet, so it walks what it can reach and says plainly what it left out — which is more useful than waiting.',
     });
+    // Nothing said this existed, anywhere. A person ran a check, watched a blank terminal for
+    // minutes, and reasonably asked why there was no window — the panel was there the whole
+    // time behind a flag nobody had been told about. A run that looks like nothing is
+    // happening is indistinguishable from a run that is stuck, which is the state somebody
+    // kills it in. Said once, here, where a person is deciding what to type next.
+    // Measured 2026-09-01.
+    const hasAScreen =
+      (project.pages?.length ?? 0) > 0
+      || project.products.some((p) => ['web', 'electron', 'ios', 'android', 'macos', 'linux', 'windows', 'extension'].includes(String(p.surface)));
+    if (hasAScreen) {
+      next.push({
+        command: 'staysfixed check --watch',
+        what: 'The same run, with a window beside it drawing every screen as it is walked. Worth it once, to see what this actually does. It opens behind what you are working on; --watch-front brings it forward.',
+      });
+    }
   }
   if (project.tests.files > 0) {
     next.push({ command: 'staysfixed check --journeys suite', what: `Walk the ${project.tests.files} test${project.tests.files === 1 ? '' : 's'} this project already has, under instrumentation.` });

package/src/v2/watch/dialogs.js

@@ -0,0 +1,410 @@
+/**
+ * The system dialogs this tool causes, and what to do about them.
+ *
+ * ## What went wrong, 2026-09-01
+ *
+ * A real check on a real product ran for four minutes and spent the last two of them frozen.
+ * The owner recorded it. On screen, over everything, was a macOS alert:
+ *
+ *     Keychain Not Found
+ *     A keychain cannot be found to store "Terminal Deck Key."
+ *     [?]                                 [Cancel]  [Reset To Defaults]
+ *
+ * The panel sat on "Walking ask the private channel voice:status to answer" at 23 of 27
+ * journeys and never moved. When the run finally gave up it said only that one journey had no
+ * answer. It never said WHY, and the why was a modal box waiting for a person who was not
+ * going to be there — on a machine where nobody had been asked to sit and watch.
+ *
+ * ## Why this is the tool's problem and not the product's
+ *
+ * Every adapter here starts the thing under test in a THROWAWAY settings folder, on its own
+ * ports, under its own name, so that a run can never touch the real install. That isolation is
+ * the whole design, and a fresh settings folder is exactly the condition that makes an
+ * application ask the operating system for something it has never been granted: a keychain, a
+ * microphone, the Documents folder, permission to control another app. So these dialogs are a
+ * NORMAL consequence of how this tool works. A tool that causes them and then hangs behind
+ * them, silently, is broken in its own right.
+ *
+ * ## The three rules, and why each one is a rule
+ *
+ * ONLY OURS. A dialog is touched only when it belongs to an application this run started, and
+ * the caller supplies that list — the same `ours` bookkeeping the screen guard keeps. His own
+ * apps ask him things all day and none of it is any of this tool's business. Getting this
+ * wrong would mean a background check silently answering a prompt in his email client.
+ *
+ * ONLY HARMLESS BUTTONS. The button pressed comes from a fixed list of ones that decline,
+ * dismiss or close, and nothing else is ever pressed. On the very dialog that started this,
+ * the other button was "Reset To Defaults" — on a keychain — which is a change to the machine
+ * that no automated run may make on somebody's behalf. When there is no harmless button, the
+ * dialog is left exactly as it is and reported instead. A tool that cannot act safely says so;
+ * it does not guess.
+ *
+ * SAY IT HAPPENED. Every dialog seen is recorded with its words, whether it could be dismissed
+ * or not, and the check reports it. "No answer for one journey" is a fact with no cause in it.
+ * "No answer, because your app put up a box saying a keychain cannot be found, and I closed it"
+ * is the same fact with the thing a person needs in order to act.
+ *
+ * Everything here is best effort and every failure is swallowed: no window server, no Apple
+ * Events permission, a locked screen or a machine that is not a Mac all mean there are no
+ * dialogs to clear, which is never a reason to fail a check.
+ */
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+import { detail } from '../../core/log.js';
+
+const run = promisify(execFile);
+
+/** How often to look. Dialogs are not urgent — a person would take a second to notice one too. */
+const LOOK_EVERY_MS = 1200;
+
+/**
+ * The only buttons this file will ever press.
+ *
+ * Every one of them declines, dismisses or closes. Nothing here grants anything, changes a
+ * setting, deletes anything or agrees to anything. The list is deliberately short and
+ * deliberately literal: a fuzzy match would eventually press "Allow" because it contained
+ * "low", and the whole safety of this file is that it cannot.
+ */
+const SAFE_BUTTONS = [
+  'Cancel',
+  "Don't Allow",
+  'Don’t Allow',
+  'Deny',
+  'Not Now',
+  'Later',
+  'Close',
+  'Dismiss',
+  'No',
+  'Quit',
+];
+
+/**
+ * Buttons that must never be pressed even if some future edit adds them above.
+ *
+ * A second, independent gate. `SAFE_BUTTONS` is the allow-list and this is the veto, and a
+ * button has to get past both. It exists because the failure this file guards against is not
+ * "the wrong button was pressed once" — it is "somebody widened the allow-list a year from now
+ * and nobody noticed what it now includes".
+ */
+const NEVER_PRESS = [
+  'reset',
+  'allow',
+  'delete',
+  'erase',
+  'remove',
+  'ok',
+  'yes',
+  'continue',
+  'agree',
+  'accept',
+  'grant',
+  'always',
+  'trust',
+  'update',
+  'install',
+  'send',
+  'share',
+];
+
+/**
+ * @typedef {object} SeenDialog
+ * @property {string} app        The application it belongs to.
+ * @property {string} title      Its window title, when it has one.
+ * @property {string} says       The text on it, joined into one line.
+ * @property {string|null} closed The button pressed, or null when it was left alone.
+ * @property {string|null} why    Why it was left alone, when it was.
+ * @property {number} at         Milliseconds into the run.
+ */
+
+/**
+ * Is this a button this file is allowed to press?
+ *
+ * @param {string} label
+ * @returns {boolean}
+ */
+export function mayPress(label) {
+  const name = String(label ?? '').trim();
+  if (name.length === 0) return false;
+  const lower = name.toLowerCase();
+  // The veto runs first and on the whole label, so "Reset To Defaults" is refused before
+  // anything else gets a chance to like the look of it.
+  for (const banned of NEVER_PRESS) {
+    if (lower.split(/[^a-z’']+/).includes(banned)) return false;
+  }
+  return SAFE_BUTTONS.some((safe) => safe.toLowerCase() === lower);
+}
+
+/**
+ * Pick the button to press out of what a dialog offers.
+ *
+ * @param {string[]} labels
+ * @returns {string|null}
+ */
+export function safeButton(labels) {
+  const offered = (labels ?? []).map((l) => String(l ?? '').trim()).filter(Boolean);
+  // In SAFE_BUTTONS order rather than in the dialog's order, so the answer does not depend on
+  // how somebody laid their buttons out.
+  for (const wanted of SAFE_BUTTONS) {
+    const hit = offered.find((l) => l.toLowerCase() === wanted.toLowerCase() && mayPress(l));
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * Every modal box currently up, for the applications named.
+ *
+ * WHAT COUNTS AS A DIALOG, and this took measuring rather than guessing. The obvious test is
+ * the window's subrole, and it is wrong: on this Mac an ordinary Terminal window, Activity
+ * Monitor and System Settings all report `AXDialog`, the same value the real keychain alert
+ * reports. A tool matching on that would go hunting for buttons to press on somebody's actual
+ * work. The attribute that does separate them is **AXModal** — measured true on the alert and
+ * false on all four of his open Terminal windows — which is also the honest definition of the
+ * thing being fixed here: a box that blocks. Sheets are included because a sheet is modal to
+ * the window it hangs off whatever it says about itself.
+ *
+ * One `osascript` call for the whole sweep. The output is one record per line, tab separated,
+ * because parsing AppleScript's own list syntax is a worse idea than choosing a separator.
+ *
+ * @param {string[]} apps
+ * @returns {Promise<{app: string, title: string, says: string, buttons: string[]}[]>}
+ */
+export async function dialogsUp(apps) {
+  if (process.platform !== 'darwin' || !apps || apps.length === 0) return [];
+  const list = '{' + apps.map((a) => JSON.stringify(String(a))).join(', ') + '}';
+  const script = `
+    set out to ""
+    tell application "System Events"
+      repeat with wanted in ${list}
+        repeat with proc in (every application process whose name is (wanted as string))
+          try
+            repeat with win in (every window of proc)
+              set isDialog to false
+              try
+                if (value of attribute "AXModal" of win) is true then set isDialog to true
+              end try
+              try
+                if subrole of win is "AXSystemDialog" then set isDialog to true
+              end try
+              -- NOT "sheets". Inside a System Events tell block that word is an element name,
+              -- so "set sheets to {}" is read as "set every sheet to {}" and throws -10006.
+              -- The error was swallowed by the try around this loop and the whole sweep came
+              -- back empty, which looked exactly like a machine with no dialogs on it.
+              set sheetCount to 0
+              set firstSheet to missing value
+              try
+                set theSheets to every sheet of win
+                set sheetCount to (count of theSheets)
+                if sheetCount > 0 then set firstSheet to item 1 of theSheets
+              end try
+              if (isDialog) or (sheetCount > 0) then
+                set target to win
+                if sheetCount > 0 then set target to firstSheet
+                set theTitle to ""
+                try
+                  set theTitle to name of target as string
+                end try
+                set theText to ""
+                try
+                  repeat with t in (every static text of target)
+                    set theText to theText & (value of t as string) & " "
+                  end repeat
+                end try
+                set theButtons to ""
+                try
+                  repeat with b in (every button of target)
+                    set theButtons to theButtons & (name of b as string) & "|"
+                  end repeat
+                end try
+                set out to out & (name of proc as string) & tab & theTitle & tab & theText & tab & theButtons & linefeed
+              end if
+            end repeat
+          end try
+        end repeat
+      end repeat
+    end tell
+    return out
+  `;
+  try {
+    const { stdout } = await run('osascript', ['-e', script], { timeout: 6000 });
+    return stdout
+      .split('\n')
+      .map((line) => line.replace(/\r$/, ''))
+      .filter((line) => line.trim().length > 0)
+      .map((line) => {
+        const [app = '', title = '', says = '', buttons = ''] = line.split('\t');
+        return {
+          app: app.trim(),
+          title: title.trim(),
+          says: says.replace(/\s+/g, ' ').trim(),
+          buttons: buttons.split('|').map((b) => b.trim()).filter(Boolean),
+        };
+      })
+      .filter((d) => d.app.length > 0);
+  } catch {
+    // No window server, no permission, a locked screen. There is nothing to clear.
+    return [];
+  }
+}
+
+/**
+ * Press one button on one application's frontmost dialog.
+ *
+ * @param {string} app
+ * @param {string} button
+ * @returns {Promise<boolean>}
+ */
+export async function pressButton(app, button) {
+  if (process.platform !== 'darwin') return false;
+  if (!mayPress(button)) return false;
+  const script = `
+    tell application "System Events"
+      tell (first application process whose name is ${JSON.stringify(app)})
+        repeat with win in (every window of it)
+          try
+            set target to win
+            try
+              if (count of (every sheet of win)) > 0 then set target to item 1 of (every sheet of win)
+            end try
+            click (first button of target whose name is ${JSON.stringify(button)})
+            return "pressed"
+          end try
+        end repeat
+      end tell
+    end tell
+    return "no"
+  `;
+  try {
+    const { stdout } = await run('osascript', ['-e', script], { timeout: 6000 });
+    return stdout.trim() === 'pressed';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @typedef {object} DialogWatcher
+ * @property {(name: string) => void} claim    Name an application this run started.
+ * @property {() => Promise<void>} stop        Stop watching. Safe to call twice.
+ * @property {() => SeenDialog[]} report       Every dialog seen, in the order they appeared.
+ * @property {() => Promise<void>} sweepNow    Look once, right now. For tests and for the end of a run.
+ */
+
+/**
+ * Watch for modal boxes belonging to what this run started, close the harmless ones, and
+ * remember all of them.
+ *
+ * `look` and `press` exist for the same reason the screen guard has them: the decisions here —
+ * whose dialog it is, which button qualifies, what gets recorded when nothing can be pressed —
+ * are the part that has to be right, and they are unreachable behind two `osascript` calls
+ * that answer differently on every machine and not at all on most.
+ *
+ * @param {{claims?: string[], everyMs?: number, elapsed?: () => number, look?: (apps: string[]) => Promise<any[]>, press?: (app: string, button: string) => Promise<boolean>}} [opts]
+ * @returns {DialogWatcher}
+ */
+export function watchForDialogs(opts = {}) {
+  const everyMs = opts.everyMs ?? LOOK_EVERY_MS;
+  const look = opts.look ?? dialogsUp;
+  const press = opts.press ?? pressButton;
+  const elapsed = opts.elapsed ?? (() => 0);
+
+  /** @type {Set<string>} */
+  const ours = new Set(opts.claims ?? []);
+  /** @type {SeenDialog[]} */
+  const seen = [];
+  /** Dialogs already recorded, so one box sitting there for a minute is one line, not fifty. */
+  const already = new Set();
+  let stopped = process.platform !== 'darwin' && !opts.look;
+  /** @type {ReturnType<typeof setTimeout>|null} */
+  let timer = null;
+
+  const sweep = async () => {
+    if (stopped || ours.size === 0) return;
+    let up = [];
+    try {
+      up = await look([...ours]);
+    } catch {
+      return;
+    }
+    for (const d of up ?? []) {
+      const key = `${d.app}${d.title}${d.says}`;
+      if (already.has(key)) continue;
+      const button = safeButton(d.buttons ?? []);
+      let closed = null;
+      let why = null;
+      if (button) {
+        const done = await press(d.app, button).catch(() => false);
+        if (done) closed = button;
+        else why = `tried to press "${button}" and the click did not land`;
+      } else {
+        // Recorded, not guessed at. The offered buttons go into the reason so a person reading
+        // the run knows exactly what they are being asked and why nothing was pressed.
+        why =
+          (d.buttons ?? []).length > 0
+            ? `nothing on it is safe for a machine to press: ${(d.buttons ?? []).join(', ')}`
+            : 'it offered no button this tool could find';
+      }
+      already.add(key);
+      seen.push({ app: d.app, title: d.title ?? '', says: d.says ?? '', closed, why, at: elapsed() });
+      detail(
+        `A dialog from ${d.app} said "${d.says || d.title}" — ` +
+          (closed ? `closed it with "${closed}".` : `left it alone: ${why}.`),
+      );
+    }
+  };
+
+  const tick = async () => {
+    await sweep();
+    if (!stopped) timer = setTimeout(tick, everyMs);
+  };
+  if (!stopped) timer = setTimeout(tick, everyMs);
+
+  return {
+    claim: (name) => {
+      if (name) ours.add(name);
+    },
+    stop: async () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+      timer = null;
+    },
+    report: () => seen.slice(),
+    sweepNow: sweep,
+  };
+}
+
+/**
+ * One plain sentence about the dialogs a run met, or nothing when it met none.
+ *
+ * Written to be read after the verdict, by somebody who has just been told a journey had no
+ * answer and needs to know why.
+ *
+ * @param {SeenDialog[]} seen
+ * @returns {string|null}
+ */
+export function describeDialogs(seen) {
+  const all = seen ?? [];
+  if (all.length === 0) return null;
+  const closed = all.filter((d) => d.closed);
+  const left = all.filter((d) => !d.closed);
+  const parts = [];
+  if (closed.length > 0) {
+    const first = closed[0];
+    parts.push(
+      `${closed.length === 1 ? 'A box' : `${closed.length} boxes`} came up from the app this run started and ` +
+        `${closed.length === 1 ? 'was' : 'were'} closed with "${first.closed}"` +
+        `${first.says ? `: "${first.says}"` : ''}. Anything walked while it was up may have had no answer for that reason.`,
+    );
+  }
+  if (left.length > 0) {
+    const first = left[0];
+    parts.push(
+      `${left.length === 1 ? 'A box is' : `${left.length} boxes are`} still up and ${left.length === 1 ? 'was' : 'were'} ` +
+        `left alone, because ${first.why}${first.says ? `. It says: "${first.says}"` : ''}. ` +
+        'Nothing here presses a button that could change your machine.',
+    );
+  }
+  return parts.join(' ');
+}

package/src/v2/watch/panel.js

@@ -568,7 +568,10 @@ button { font: inherit; color: inherit; }
 }
 
 /* --- the scrolling body -------------------------------------------------- */
-.scroll { flex: 1 1 auto; min-height: 0; overflow-y: auto; overflow-x: hidden; padding: 0 var(--pad) 18px; }
+/* A FLOOR, so the report can never be reduced to a slit again. Whatever else is on screen,
+   the body keeps enough height to show a heading and a few rows under it — which is the
+   difference between "there is more here, scroll" and "the detail is gone". */
+.scroll { flex: 1 1 auto; min-height: 132px; overflow-y: auto; overflow-x: hidden; padding: 0 var(--pad) 18px; }
 .scroll::-webkit-scrollbar { width: 9px; }
 .scroll::-webkit-scrollbar-thumb { background: var(--resting); border-radius: 999px; }
 .scroll::-webkit-scrollbar-track { background: transparent; }
@@ -778,8 +781,25 @@ button { font: inherit; color: inherit; }
 .nothing { padding: 30px 16px; color: var(--faint); font-size: var(--t-body); line-height: 1.8; text-align: center; }
 
 /* --- the only thing that ever reaches a person --------------------------- */
+/* THE FOOTER MAY NEVER EAT THE WINDOW.
+   It used to be "flex: 0 0 auto" with nothing capping it, so its height was simply however
+   many things needed a person. On a real run that found seventeen, the footer grew past the
+   height of the whole panel and squeezed the scrolling body — the walk, the wobble, what
+   survived, what was not checked, every journey and its address count — down to EIGHTEEN
+   PIXELS holding 41,115 of content. Measured, not guessed: clientHeight 18, scrollHeight
+   41115. What a person saw at the end of a run was one clipped line of text where the whole
+   report had been a second earlier, which reads exactly like the tool throwing its detail
+   away at the moment it finishes.
+   So it shrinks now, the list inside it scrolls, and the body below keeps a floor. */
 .foot {
+  /* Sizes to its content, and stops at half the window. Not "0 1 auto": that let the flex
+     row below it take every pixel and shrank the footer to its label, so seventeen things
+     needing a person rendered at zero height — the same detail lost, from the other end. */
   flex: 0 0 auto;
+  max-height: 52%;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
   padding: 13px var(--pad) 15px;
   background: var(--glass);
   backdrop-filter: blur(22px) saturate(120%);
@@ -787,6 +807,12 @@ button { font: inherit; color: inherit; }
   border-top: 1px solid var(--line);
   animation: arrive 340ms var(--ease) both;
 }
+/* The label above and the sentence below stay put; only the list moves. A person reading
+   "Needs a person" must never have to scroll to find out that is what they are reading. */
+#needs { flex: 1 1 auto; min-height: 0; overflow-y: auto; overflow-x: hidden; }
+#needs::-webkit-scrollbar { width: 9px; }
+#needs::-webkit-scrollbar-thumb { background: var(--resting); border-radius: 999px; }
+#needs::-webkit-scrollbar-track { background: transparent; }
 .nextlabel {
   font-size: var(--t-label); font-weight: 600; letter-spacing: 0.2em;
   text-transform: uppercase; color: var(--wait); margin-bottom: 8px;