staysfixed 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this project are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the version
 numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.1] — 2026-08-30
+
+Documentation only, and it is a correction rather than a polish. The README
+described where journeys come from in the words of the design — read the code,
+then harvest the project's own test suite, then recorded sessions — and only the
+first of those is wired into `staysfixed check`. The suite harvest, session
+recording and the flake register are written and tested in `src/v2/journeys/` and
+nothing on the check path calls them. Both places that implied otherwise now say
+so plainly. A feature that exists in the repository and not in the run is not a
+feature you have.
+
 ## [0.6.0] — 2026-08-30
 
 The second sweep for silences, done the same way as the first: read all of

package/README.md

@@ -148,6 +148,7 @@ pretend otherwise.
 | The reference cut when you ship, sealed intents, the waiver budget, and escalations in your closing summary | **Works.** This page describes what it actually does. |
 | The coverage ledger — every door counted, the unopened ones named, and the sentence saying so on every reply | **Works.** See [what it did not check](#what-it-did-not-check). |
 | Aiming a check at one kind of product, and refusing by name rather than checking something else | **Works.** |
+| Steps taken from your own test suite, from a recorded session, or rejected at birth for not repeating twice | **Written, not wired.** The code is in `src/v2/journeys/` with tests around it, and nothing on the check path calls it yet. Journeys today come from what each adapter reads out of your source, plus any `--journeys` file you name. |
 | Android APKs on an emulator | **The adapter is here.** It reads everything the APK declares with nothing installed and no Java, and where there is an emulator it installs one build at a time and walks it. Whether *this* machine can run one is a separate question, and `doctor` asks the adapter itself rather than keeping a second opinion — most of what it wants installs with a command; accepting Google's licence, once, needs a person. Two emulator snapshots restoring byte-identically is unproven, so Android compares against the stored record and says which mode it used. |
 | The iOS simulator | **The adapter is here.** It reads what the app bundle declares with nothing running, and where Xcode and a simulator runtime are present it installs one build at a time, boots it and reads what is on the screen. It is new. Paired running costs two `xcodebuild` passes, so it is for before a release rather than for every edit, and like Android it compares against the stored record and says which mode it used. Ask `doctor` what it is actually covering on your machine before trusting a clean run. |
 | Native Windows GUI (a real Win32 app, not an Electron one) | **The probe is here**, driven over ssh to any machine that reaches a Windows desktop — a WSL shell on one counts, and nothing is installed on it. Windows shows one desktop, so two builds can never run at once: the comparison is genuinely weaker here than anywhere else. |
@@ -232,6 +233,14 @@ under instrumentation → recorded real sessions → the agent exploring one nam
 gap and freezing it into a replayable file → never a person clicking through an
 app.
 
+What is actually wired into `staysfixed check` today is the first of those and a
+journeys file you point it at: each adapter reads your source and offers the
+journeys it can walk — routes, commands, screens, message channels — and
+`--journeys <file>` names steps by hand. The suite harvest, recorded sessions and
+the flake register are written and tested in `src/v2/journeys/`, and **nothing on
+the check path calls them yet**. Saying so is the point: a feature that exists in
+the repository and not in the run is not a feature you have.
+
 ## Keeping it quiet
 
 Four layers before anything reaches the agent: **normalise** volatile shapes by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "staysfixed",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Prove that what already worked still works after an agent changed the code. Picture checks, guards for fixed bugs, a pre-release walkthrough, and known-good markers — as a CLI and as an MCP server.",
   "type": "module",
   "license": "MIT",

package/src/v2/adapters/android-driver.js

@@ -1183,7 +1183,14 @@ export function looksIrreversible(method, url) {
  * in the background is filed separately, and this limit is stated in the adapter's own
  * description rather than hidden here.
  */
-const DEVICE_HOSTS = /(^|\.)(google|googleapis|gstatic|android|gvt1|gvt2|doubleclick|crashlytics|firebaseinstallations)\.com$|(^|\.)google\.[a-z.]+$/i;
+/*
+ * Every one of these was seen leaving a Google APIs emulator on 2026-08-30 while Terminal
+ * Deck — an app that talks to one relay and nothing else — sat on its first screen. The
+ * ones added that day are on the second line: `googleadservices` and `youtube` were being
+ * filed as calls THE APP made, which reads as "your change made the app phone YouTube" and
+ * is the most alarming false alarm this adapter is capable of producing.
+ */
+const DEVICE_HOSTS = /(^|\.)(google|googleapis|gstatic|android|gvt1|gvt2|doubleclick|crashlytics|firebaseinstallations)\.com$|(^|\.)(googleadservices|googlesyndication|googletagmanager|googleusercontent|google-analytics|youtube|ytimg|ggpht|appspot)\.com$|(^|\.)google\.[a-z.]+$/i;
 
 /**
  * @param {string} host

package/src/v2/adapters/android.js

@@ -953,22 +953,54 @@ export const androidAdapter = defineAdapter({
         const key = `${call.method} ${call.host}${call.route}`;
         byCall.set(key, (byCall.get(key) ?? 0) + 1);
       }
+      /**
+       * The phone's own background chatter is COUNTED, never given an address of its own.
+       *
+       * A device-wide proxy sees the whole phone, and on a Google APIs emulator most of what
+       * it sees is Play services: checking connectivity, fetching fonts, asking about digital
+       * asset links, phoning gmscompliance. None of it belongs to the app being checked, none
+       * of it is the same twice, and every one of those hosts given an address of its own is
+       * an address that appears in one run and is gone in the next.
+       *
+       * Measured on Terminal Deck on 2026-08-30, on a build with NOTHING changed in it: eight
+       * findings, seven of them a Google host that came or went. Running the build twice
+       * subtracted fifteen more and still could not subtract those, because this traffic is
+       * not merely unstable — it is episodic, so a run pair can agree with itself and still
+       * disagree with the run pair before it. Left as it was, an Android check reports noise
+       * on a build nobody touched, and the first thing anybody does with a tool that cries
+       * wolf is switch it off.
+       *
+       * So: the app's own calls keep one address each, which is the signal worth having, and
+       * the phone's own are reduced to a count that sits on one rung of a coarse ladder. What
+       * was seen is still said in plain English, and the ledger still records that nothing
+       * inside those requests was ever opened.
+       */
+      let fromThePhone = 0;
       for (const [key, times] of [...byCall.entries()].sort()) {
         const call = calls.find((c) => `${c.method} ${c.host}${c.route}` === key);
         if (!call) continue;
-        const mine = !isDeviceHost(call.host);
-        if (mine) fromTheApp += 1;
+        if (isDeviceHost(call.host)) {
+          fromThePhone += 1;
+          continue;
+        }
+        fromTheApp += 1;
         out.push(observation({
           channel: 'effects',
-          path: joinPath('net', journey.name, mine ? 'the app' : 'the phone itself', key),
+          path: joinPath('net', journey.name, 'the app', key),
           value: { asked: countBucket(times), reached: call.allowed ? 'let through' : 'stopped here' },
-          says: `${mine ? 'the app' : 'the phone, not the app,'} tried to call ${key}${times > 1 ? ` ${times} times` : ''} — ${call.why}`,
+          says: `the app tried to call ${key}${times > 1 ? ` ${times} times` : ''} — ${call.why}`,
           covered: call.how === 'encrypted' ? false : undefined,
           reason: call.how === 'encrypted' ? 'not supported here' : undefined,
           journey: journey.name,
           surface: 'android',
         }));
       }
+      out.push(notCovered({
+        channel: 'effects',
+        path: joinPath('net', journey.name, 'the phone itself'),
+        reason: 'not supported here',
+        says: `${fromThePhone === 0 ? 'nothing else on the phone' : `${fromThePhone} other thing${fromThePhone === 1 ? '' : 's'} on the phone`} reached out while this ran — Android\'s own services, not this app. It is watched and stopped here like everything else, and it is not compared, because a device-wide proxy cannot tell which program made a call and Google\'s background traffic is different every single run.`,
+      }));
       out.push(observation({
         channel: 'counters',
         path: joinPath('count', journey.name, 'calls the app made'),