staysfixed 0.8.0 → 0.9.1

package/src/report/console.js

@@ -124,7 +124,11 @@ function tally(run) {
     missing: pictures.filter((p) => p.status === 'missing').length,
     broken: pictures.filter((p) => p.status === 'failed').length,
     wobbled: pictures.filter((p) => p.status === 'flaky').length,
-    guardsFailed: guards.filter((g) => g.status === 'failed').length,
+    // Two different things wear the same status, and calling both of them "a bug is back"
+    // sends somebody hunting a regression that never happened. A guard that asked no
+    // question at all has not caught anything; it has admitted it cannot.
+    guardsFailed: guards.filter((g) => g.status === 'failed' && !(/** @type {any} */ (g).assertedNothing)).length,
+    guardsEmpty: guards.filter((g) => /** @type {any} */ (g).assertedNothing === true).length,
   };
 }
 
@@ -139,6 +143,20 @@ export function verdictFor(run) {
   const parts = [];
   if (t.guardsFailed === 1) parts.push({ n: 1, text: '1 guard failed — a bug that was already fixed is back.' });
   else if (t.guardsFailed > 1) parts.push({ n: t.guardsFailed, text: `${countText(t.guardsFailed)} guards failed — bugs that were already fixed are back.` });
+  // Said even on a green run, because that is the run it changes the meaning of.
+  const left = /** @type {any} */ (run).leftOut;
+  if (left && (left.screens > 0 || left.guards > 0)) {
+    const bits = [];
+    if (left.screens > 0) bits.push(`${left.screens} ${left.screens === 1 ? 'screen' : 'screens'}`);
+    if (left.guards > 0) bits.push(`${left.guards} ${left.guards === 1 ? 'guard' : 'guards'}`);
+    const how_many = (left.screens ?? 0) + (left.guards ?? 0);
+    parts.push({
+      n: 0,
+      text: `${bits.join(' and ')} ${how_many === 1 ? 'was' : 'were'} left out by --only, so this covers a slice and not the whole.`,
+    });
+  }
+  if (t.guardsEmpty === 1) parts.push({ n: 1, text: '1 guard checks nothing, so it is not protecting anything.' });
+  else if (t.guardsEmpty > 1) parts.push({ n: t.guardsEmpty, text: `${countText(t.guardsEmpty)} guards check nothing, so they are not protecting anything.` });
   if (t.changed === 1) parts.push({ n: 1, text: '1 thing changed. Look at it before you ship.' });
   else if (t.changed > 1) parts.push({ n: t.changed, text: `${countText(t.changed)} things changed. Look at them before you ship.` });
   if (t.fresh === 1) parts.push({ n: 1, text: '1 new screen is waiting for a person to approve it.' });
@@ -162,9 +180,12 @@ export function verdictFor(run) {
  * @param {import('../types.js').RunSummary} run
  * @returns {boolean}
  */
-function allClear(run) {
+export function allClear(run) {
   const t = tally(run);
-  return t.changed + t.fresh + t.missing + t.broken + t.wobbled + t.guardsFailed === 0;
+  // `guardsEmpty` counts too. Splitting it out of `guardsFailed` was so the SENTENCE could
+  // tell a returned bug from a guard that asks nothing — not so that one of them could
+  // quietly become a pass.
+  return t.changed + t.fresh + t.missing + t.broken + t.wobbled + t.guardsFailed + t.guardsEmpty === 0;
 }
 
 /**
@@ -561,6 +582,8 @@ export function printFlakes(history, flakeLimit = 2) {
  * @property {number} [markers]       Known-good markers saved.
  * @property {{label: string, at?: string}|null} [lastMarker]
  * @property {import('../types.js').RunSummary|null} [lastRun]
+ * @property {{at: string, verdict: string, reference: string|null, findings: number}|null} [v2]
+ *   What version 2 has recorded here. Version 1's counts say nothing about it.
  * @property {string[]} [condemned]   Names from the flake register, if the CLI already has them.
  * @property {string} [configFile]
  * @property {string} [root]
@@ -591,7 +614,15 @@ export function printStatus(status) {
 
   blank();
   const run = s.lastRun ?? null;
-  if (!run) {
+  if (!run && s.v2) {
+    // Version 2 has run here even though version 1's picture record has not. Saying
+    // "nothing has been checked here yet" one command after a real run is the sort of
+    // wrongness that costs a person their trust in everything else the tool says.
+    say(paint.grey(`  last checked ${ago(s.v2.at)} — ${s.v2.verdict}`));
+    if (s.v2.findings > 0) say(paint.grey(`  ${s.v2.findings} ${plural(s.v2.findings, 'thing', 'things')} nobody had accounted for`));
+    if (s.v2.reference) say(paint.grey(`  compared against ${s.v2.reference}`));
+    else say(`  Nothing is on record as working yet — run ${paint.cyan('staysfixed check')}, then ${paint.cyan('staysfixed ship')}.`);
+  } else if (!run) {
     say('  Nothing has been checked here yet.');
     say(`  Start with: ${paint.cyan('staysfixed check')}`);
   } else {

package/src/run.js

@@ -226,6 +226,17 @@ export async function runCheck(project, opts = {}) {
     tool: TOOL,
     platform: platformTag(),
     condemned: condemnedNames,
+    // What `--only` left out. A narrowed run that says "everything that worked still works"
+    // is describing a slice and sounding like the whole: measured 2026-08-30 with five of
+    // six guards filtered away and one of the five failing, and the run still exited 0
+    // saying everything works. A pass has to carry the size of what it looked at.
+    leftOut: terms
+      ? {
+          screens: Math.max(0, allScreens.length - screens.length),
+          guards: Math.max(0, allGuards.length - guards.length),
+          terms,
+        }
+      : undefined,
     // Read here rather than at the very end: what follows is writing files, and
     // where the run spent its time is a fact about the run, not about the report.
     timings: timings.get(),

package/src/types.js

@@ -328,6 +328,9 @@
  * @property {string} tool
  * @property {string} platform
  * @property {string[]} [condemned]           Names of checks that have flaked past the limit.
+ * @property {{screens: number, guards: number, terms: string[]}} [leftOut]
+ *   What `--only` filtered away. A narrowed run that reads as a full pass is describing a
+ *   slice and sounding like the whole.
  */
 
 /**

package/src/v2/adapters/child.js

@@ -0,0 +1,101 @@
+/**
+ * Starting and stopping the product's own server.
+ *
+ * A start command is run through a shell, because that is what people write: `npm run dev`,
+ * `sh dev.sh`, `poetry run uvicorn ...`. So the thing that is spawned is the SHELL, and the
+ * server is its child — often its grandchild, since `npm run dev` is npm, which runs next,
+ * which runs node.
+ *
+ * Killing the shell therefore does not kill the server. And because the shell's stdout and
+ * stderr are pipes, every survivor inherits the writing end of them — so the pipes never
+ * close, this process's event loop never empties, and `staysfixed check` prints its whole
+ * answer and then hangs for ever at nothing per cent of a CPU. Measured on 2026-08-30 on a
+ * start command that spawns its server and waits, which is the shape `npm run dev` has: the
+ * verdict appeared in about thirty seconds and the command never returned.
+ *
+ * So the shell is started as its own process GROUP and the whole group is signalled. And
+ * after that, the pipes are torn down here rather than trusted to close, because a survivor
+ * this file did not start — a stray `node` somebody's dev server left behind — must not be
+ * able to hold a finished check open.
+ */
+
+import { spawn } from 'node:child_process';
+
+/**
+ * Start the product, in a group of its own.
+ *
+ * @param {string} command
+ * @param {{cwd: string, env: any, stdio?: any}} opts
+ * @returns {import('node:child_process').ChildProcess}
+ */
+export function spawnServer(command, opts) {
+  return spawn(String(command), {
+    shell: true,
+    cwd: opts.cwd,
+    env: opts.env,
+    stdio: opts.stdio ?? ['ignore', 'pipe', 'pipe'],
+    // The whole point. On Windows there are no process groups of this kind, and killing the
+    // child is the best that can be done there.
+    detached: process.platform !== 'win32',
+  });
+}
+
+/**
+ * Stop it, and everything it started.
+ *
+ * @param {import('node:child_process').ChildProcess|null|undefined} child
+ * @param {{graceMs?: number}} [opts]
+ * @returns {Promise<void>}
+ */
+export async function stopServer(child, opts = {}) {
+  if (!child) return;
+  const pid = child.pid;
+  const graceMs = opts.graceMs ?? 500;
+
+  /** @param {NodeJS.Signals} signal */
+  const tellTheGroup = (signal) => {
+    if (!pid) return;
+    try {
+      // A negative pid is the GROUP. This is the line that makes the difference.
+      if (process.platform === 'win32') child.kill(signal);
+      else process.kill(-pid, signal);
+    } catch {
+      // No group, or already gone. Ask the one process we definitely know about.
+      try {
+        child.kill(signal);
+      } catch {
+        // Already gone, which is the outcome wanted.
+      }
+    }
+  };
+
+  if (child.exitCode === null && child.signalCode === null) {
+    tellTheGroup('SIGTERM');
+    await new Promise((done) => {
+      let settled = false;
+      const finish = () => {
+        if (settled) return;
+        settled = true;
+        done(undefined);
+      };
+      child.once('exit', finish);
+      const timer = setTimeout(finish, graceMs);
+      if (typeof timer.unref === 'function') timer.unref();
+    });
+    if (child.exitCode === null && child.signalCode === null) tellTheGroup('SIGKILL');
+  }
+
+  // And never let what it left behind hold this process open.
+  for (const stream of [child.stdout, child.stderr, child.stdin]) {
+    try {
+      stream?.destroy();
+    } catch {
+      // Nothing to close.
+    }
+  }
+  try {
+    child.unref();
+  } catch {
+    // Not every child can be unreferenced. It has been signalled either way.
+  }
+}

package/src/v2/adapters/http.js

@@ -31,7 +31,6 @@
 import fsp from 'node:fs/promises';
 import net from 'node:net';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
 import {
   defineAdapter, joinPath, notCovered, observation, sizeBucket, stableValue,
   howLongItTook, timeBucket, trimForStorage, undoOurFootprint,
@@ -40,6 +39,7 @@ import {
   compareTrees, copyForScratch, frozenEnvironment, readWatcher, snapshotTree, watcherScript,
 } from './process.js';
 import { readContract, readFileRoutes } from './source.js';
+import { spawnServer, stopServer } from './child.js';
 
 // ---------------------------------------------------------------------------
 // Headers
@@ -456,7 +456,7 @@ export const httpAdapter = defineAdapter({
         notes.push(verdict.why);
       } else {
         const result = await new Promise((resolve) => {
-          const child = spawn(String(config.restore), { shell: true, cwd: work, env, stdio: ['ignore', 'pipe', 'pipe'] });
+          const child = spawnServer(String(config.restore), { cwd: work, env });
           /** @type {Buffer[]} */
           const err = [];
           child.stderr?.on('data', (c) => err.push(c));
@@ -483,7 +483,7 @@ export const httpAdapter = defineAdapter({
     /** @type {Buffer[]} */
     const bootOut = [];
     let exited = /** @type {string|null} */ (null);
-    const child = spawn(String(config.start), { shell: true, cwd: work, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawnServer(String(config.start), { cwd: work, env });
     child.stdout?.on('data', (c) => bootOut.push(c));
     child.stderr?.on('data', (c) => bootErr.push(c));
     child.on('close', (code, signal) => {
@@ -496,11 +496,11 @@ export const httpAdapter = defineAdapter({
     });
 
     if (!up.up) {
-      child.kill('SIGTERM');
+      await stopServer(child);
       return {
         build, root: work, ready: false,
         why: `${up.why} What it printed while trying: ${trimForStorage(Buffer.concat(bootErr).toString('utf8') || Buffer.concat(bootOut).toString('utf8'), 1500).text || '(nothing)'}`,
-        dispose: async () => { child.kill('SIGKILL'); await fsp.rm(base, { recursive: true, force: true }); },
+        dispose: async () => { await stopServer(child); await fsp.rm(base, { recursive: true, force: true }); },
       };
     }
 
@@ -522,9 +522,7 @@ export const httpAdapter = defineAdapter({
         if (!held) return;
         // Only ever the process we started. Somebody else's server on this machine is
         // somebody else's business.
-        held.child.kill('SIGTERM');
-        await new Promise((r) => setTimeout(r, 500));
-        if (held.child.exitCode === null) held.child.kill('SIGKILL');
+        await stopServer(held.child);
         await fsp.rm(base, { recursive: true, force: true });
       },
     };
@@ -612,7 +610,7 @@ export const httpAdapter = defineAdapter({
 
   async teardown() {
     for (const [, held] of running) {
-      held.child.kill('SIGTERM');
+      await stopServer(held.child);
     }
     running.clear();
   },

package/src/v2/adapters/process.js

@@ -180,10 +180,48 @@ export function watcherScript(opts) {
     "    write('reached out', { host: host || 'somewhere it did not name', port: port ?? null });",
     "    // Refused, not allowed through. Whatever this was going to do out there, it does not",
     "    // do it twice, and the run is reported as having a hole rather than as having passed.",
-    "    const error = new Error('Stays Fixed refused a connection to ' + (host || 'an unnamed host') + ': nothing irreversible is allowed out during a check.');",
-    "    error.code = 'ECONNREFUSED';",
-    "    process.nextTick(() => this.emit('error', error));",
-    "    return this;",
+    "    //",
+    "    // HOW the refusal arrives matters as much as that it happens. Emitting 'error' on the",
+    "    // socket ourselves reads correctly and kills the product: at that moment nothing is",
+    "    // listening on the socket yet, and in Node an 'error' event with no listener is a",
+    "    // thrown exception. `http.get` and `https.get` on Node 22 - the floor this package",
+    "    // declares in its own engines field - and a bare `net.connect` on EVERY version all",
+    "    // died that way, exit 1, and the run then reported the product as broken. A tool",
+    "    // blaming a product for something the tool itself did is the exact failure this whole",
+    "    // package exists to prevent. Measured 2026-08-30 against the published 0.8.0 watcher;",
+    "    // its own CI had been red on this for four releases and nobody read it.",
+    "    //",
+    "    // So the refusal is made real rather than simulated: the socket is pointed at a port on",
+    "    // this machine that nothing can be listening on, and the operating system produces the",
+    "    // refusal through Node's own plumbing - by which time every listener the runtime wires",
+    "    // up is in place. The product gets an ordinary ECONNREFUSED, which is exactly what it",
+    "    // would get if the host were unreachable, and cannot tell the difference.",
+    "    const named = host || 'an unnamed host';",
+    "    const explain = 'Stays Fixed refused a connection to ' + named + ': nothing irreversible is allowed out during a check.';",
+    "    const refusal = () => Object.assign(new Error(explain), { code: 'ECONNREFUSED', refusedBy: 'staysfixed' });",
+    "    // Said in the error the product actually catches, without swallowing it: prepending a",
+    "    // listener rewrites the message and still leaves every other handler to run as it would.",
+    "    this.prependListener('error', (e) => {",
+    "      if (e && e.code === 'ECONNREFUSED') { e.message = explain; e.refusedBy = 'staysfixed'; }",
+    "    });",
+    "    // Belt and braces. If something really is listening down there, the connection is cut",
+    "    // before one byte can cross it: a boundary that fails open is not a boundary.",
+    "    this.prependOnceListener('connect', () => { this.destroy(refusal()); });",
+    "    // And a machine where that port is silently dropped rather than refused would hang",
+    "    // here instead of failing, which is worse than the bug this replaced: a check that",
+    "    // never finishes tells you nothing at all. A refusal is owed promptly, so if the",
+    "    // operating system has not produced one shortly, produce it. Safe to do now, and only",
+    "    // now, because the listener above means this can never be an unhandled error.",
+    "    const soon = setTimeout(() => { if (!this.destroyed) this.destroy(refusal()); }, 250);",
+    "    if (typeof soon.unref === 'function') soon.unref();",
+    "    this.once('close', () => clearTimeout(soon));",
+    "    try {",
+    "      return connect.call(this, { port: 1, host: '127.0.0.1' });",
+    "    } catch {",
+    "      // Even the refusal failed. Still never throw into the product.",
+    "      process.nextTick(() => { if (!this.destroyed) this.destroy(refusal()); });",
+    "      return this;",
+    "    }",
     "  };",
     "} catch { /* no net module, nothing to refuse */ }",
     "",
@@ -1090,7 +1128,19 @@ export const processAdapter = defineAdapter({
  */
 export function importProbeCommand(moduleId) {
   const probe = [
-    "const m = await import(process.argv[1].startsWith('.') || process.argv[1].includes('/') ? new URL(process.argv[1], 'file://' + process.cwd() + '/').href : process.argv[1]);",
+    // A FILE unless it is really a package. The old rule was "starts with a dot, or has a
+    // slash in it" — and `index.js` has neither, so Node was asked for a PACKAGE called
+    // "index.js" and answered ERR_MODULE_NOT_FOUND. `staysfixed init` writes exactly
+    // `{ module: "index.js" }` for an ordinary package entry, so on those projects this
+    // journey failed on every run, failed the SAME way on both builds, produced no
+    // difference, and the check said "Nothing that worked has changed" for ever. Measured
+    // 2026-08-30. So: if a file of that name is really there, it is a file.
+    "const id = process.argv[1];",
+    "const { existsSync } = await import('node:fs');",
+    "const { fileURLToPath } = await import('node:url');",
+    "const asFile = new URL(id, 'file://' + process.cwd() + '/').href;",
+    "const onDisk = (() => { try { return existsSync(fileURLToPath(asFile)); } catch { return false; } })();",
+    "const m = await import(id.startsWith('.') || id.startsWith('/') || id.includes('/') || onDisk ? asFile : id);",
     "const out = {};",
     "for (const key of Object.keys(m).sort()) {",
     "  const v = m[key];",

package/src/v2/adapters/web-driver.js

@@ -174,6 +174,8 @@ export async function loadPlaywright(opts = {}) {
   // So: ask it. Only when there is no browser on the machine at all is this a real "no".
   /** @type {string|undefined} */
   let borrowedFrom;
+  /** True when the browser found is the one the PERSON uses, not a separate one. */
+  let borrowedTheirOwn = false;
   if (!there) {
     try {
       const { surveyBrowsers } = await import('../browsers.js');
@@ -181,6 +183,7 @@ export async function loadPlaywright(opts = {}) {
       if (survey.chosen?.binary && (await exists(survey.chosen.binary))) {
         executable = survey.chosen.binary;
         borrowedFrom = survey.chosen.name;
+        borrowedTheirOwn = survey.borrowingHis === true || survey.chosen.everyday === true;
         there = true;
       }
     } catch {
@@ -206,12 +209,35 @@ export async function loadPlaywright(opts = {}) {
     chromium: mod.chromium,
     version,
     executable,
-    why: borrowedFrom
-      ? `The browser driver ${version ?? ''} is here and it will open ${borrowedFrom}, which is a separate application from the browser you use, so pages can be opened.`.trim()
-      : `The browser driver ${version ?? ''} is here and its Chromium is downloaded, so pages can be opened.`.trim(),
+    why: browserNote(version, borrowedFrom, borrowedTheirOwn),
   };
 }
 
+/**
+ * What to say about the browser a check will open.
+ *
+ * "a separate application from the browser you use" used to be said whatever was found — and
+ * the one case where that sentence matters is the case where it is false. With no downloaded
+ * test browser anywhere, the survey falls back to the person's OWN browser, and this then
+ * told them the opposite of what was about to happen. A reassurance is only worth anything
+ * if it is withheld when it is not true.
+ *
+ * Exported so the wording is a test rather than a thing somebody has to notice.
+ *
+ * @param {string|undefined} version        The driver version, if it said one.
+ * @param {string|undefined} borrowedFrom   The browser found, if one had to be borrowed.
+ * @param {boolean} borrowedTheirOwn        True when that browser is the person's own.
+ * @returns {string}
+ */
+export function browserNote(version, borrowedFrom, borrowedTheirOwn) {
+  const v = version ?? '';
+  if (!borrowedFrom) return `The browser driver ${v} is here and its Chromium is downloaded, so pages can be opened.`.trim();
+  if (borrowedTheirOwn) {
+    return `The browser driver ${v} is here and the only browser on this machine is the one you use yourself (${borrowedFrom}). It will be opened invisibly with a throwaway profile, so your own settings, cookies and tabs are never touched — but it is your browser, not a separate one. \`npx playwright install chromium\` gives checks one of their own.`.trim();
+  }
+  return `The browser driver ${v} is here and it will open ${borrowedFrom}, which is a separate application from the browser you use, so pages can be opened.`.trim();
+}
+
 /**
  * @param {string} file
  * @returns {Promise<boolean>}
@@ -1489,6 +1515,20 @@ export async function runStep(page, step, opts = {}) {
         break;
     }
   }
+  // A step that did nothing at all is almost always a word this tool does not know, and
+  // saying nothing about it is the worst outcome available: the journey walks on, the sign-in
+  // never happens, every page behind the login wall photographs the login page, and the run
+  // comes back clean. `staysfixed init` itself shipped `{ fill: '#email', with: 'a@b.c' }`
+  // as its sign-in example, and neither word is in the vocabulary.
+  if (did.length === 0) {
+    const known = new Set([...ACTION_ORDER, 'text', 'timeoutMs', 'name', 'note', 'act', 'checkpoint', 'describe']);
+    const unknown = Object.keys(step).filter((k) => !known.has(k));
+    if (unknown.length > 0) {
+      throw new Error(
+        `This step does nothing: ${unknown.map((k) => `\`${k}\``).join(', ')} ${unknown.length === 1 ? 'is not a word' : 'are not words'} this tool knows, so the step was skipped and whatever it was meant to do did not happen. The steps it understands are: ${ACTION_ORDER.join(', ')} — with \`text\` beside \`type\`. To type into a field: { type: '#email', text: 'a@b.c' }.`,
+      );
+    }
+  }
   return did;
 }
 

package/src/v2/adapters/web.js

@@ -40,7 +40,6 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
 
 import {
   countBucket, defineAdapter, howLongItTook, joinPath, notCovered, observation, sizeBucket,
@@ -50,6 +49,7 @@ import { copyForScratch, frozenEnvironment } from './process.js';
 import { freePort, looksDestructive, waitForServer } from './http.js';
 import { applyFreeze, prepareForShutter } from '../../freeze/index.js';
 import { settle } from '../../freeze/settle.js';
+import { spawnServer, stopServer } from './child.js';
 import {
   actOf, countRoles, flattenAria, inkOf, loadPlaywright, openWindow, parseAria, runStep, short,
   watchTheWire, whereItIs, withLimit,
@@ -537,7 +537,7 @@ export const webAdapter = defineAdapter({
       if (!verdict.safe) notes.push(verdict.why);
       else {
         const done = await new Promise((resolve) => {
-          const child = spawn(String(config.restore), { shell: true, cwd: work, env, stdio: 'ignore' });
+          const child = spawnServer(String(config.restore), { cwd: work, env, stdio: 'ignore' });
           child.on('error', () => resolve(false));
           child.on('close', (code) => resolve(code === 0));
         });
@@ -549,7 +549,7 @@ export const webAdapter = defineAdapter({
     const said = [];
     /** @type {string|null} */
     let exited = null;
-    const child = spawn(String(config.start), { shell: true, cwd: work, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawnServer(String(config.start), { cwd: work, env });
     child.stdout?.on('data', (c) => said.push(c));
     child.stderr?.on('data', (c) => said.push(c));
     child.on('close', (code, signal) => {
@@ -558,14 +558,14 @@ export const webAdapter = defineAdapter({
 
     const up = await waitForServer(port, { timeoutMs: config.startTimeoutMs ?? 90000, crashed: () => exited });
     if (!up.up) {
-      child.kill('SIGTERM');
+      await stopServer(child);
       return {
         build,
         root: work,
         ready: false,
         why: `${up.why} What it printed while trying: ${trimForStorage(Buffer.concat(said).toString('utf8'), 1500).text || '(nothing)'}`,
         dispose: async () => {
-          child.kill('SIGKILL');
+          await stopServer(child);
           await fsp.rm(base, { recursive: true, force: true });
         },
       };
@@ -584,9 +584,7 @@ export const webAdapter = defineAdapter({
         running.delete(build.id);
         if (!held) return;
         // Only ever the process we started ourselves.
-        held.child?.kill('SIGTERM');
-        await new Promise((r) => setTimeout(r, 400));
-        if (held.child && held.child.exitCode === null) held.child.kill('SIGKILL');
+        await stopServer(held.child);
         await fsp.rm(base, { recursive: true, force: true });
       },
     };
@@ -779,7 +777,7 @@ export const webAdapter = defineAdapter({
   },
 
   async teardown() {
-    for (const [, held] of running) held.child?.kill('SIGTERM');
+    for (const [, held] of running) await stopServer(held.child);
     running.clear();
   },
 });

package/src/v2/browsers.js

@@ -270,6 +270,16 @@ function testingBrowsers() {
         take('chromium', path.join(inner, 'chrome-mac', 'Chromium.app', 'Contents', 'MacOS', 'Chromium'));
         take('chrome-for-testing', path.join(inner, 'chrome-linux', 'chrome'));
         take('chrome-for-testing', path.join(inner, 'chrome-win', 'chrome.exe'));
+        // The 64 matters, and leaving it off made this tool blind to full Chrome on every
+        // machine that is not a Mac. Playwright unpacks Linux into `chrome-linux64` and
+        // Windows into `chrome-win64`; Puppeteer does the same. Only macOS uses the names
+        // above, which is why it was never noticed here. On Linux this meant `npx playwright
+        // install chromium` - the command THIS FILE tells people to run - left a browser the
+        // survey could not see, and checks quietly fell back to the headless shell, or said
+        // there was no browser at all when the shell was not there too. Measured on a real
+        // Linux box on 2026-08-30: three Chromes present, none of them found.
+        take('chrome-for-testing', path.join(inner, 'chrome-linux64', 'chrome'));
+        take('chrome-for-testing', path.join(inner, 'chrome-win64', 'chrome.exe'));
         take('headless-shell', path.join(inner, 'chrome-headless-shell-mac-arm64', 'chrome-headless-shell'), true);
         take('headless-shell', path.join(inner, 'chrome-headless-shell-mac-x64', 'chrome-headless-shell'), true);
         take('headless-shell', path.join(inner, 'chrome-headless-shell-linux64', 'chrome-headless-shell'), true);
@@ -534,11 +544,56 @@ function killNow(pid, home) {
     } catch {
       // Already gone. That is the outcome we wanted.
     }
+    // SIGKILL is a request to the kernel, not something that has already happened, and a
+    // browser is not one process. While the parent is being reaped its children are still
+    // writing into the profile, so deleting the folder in the same breath loses the race:
+    // the sweep starts, a file appears behind it, the directory is not empty, and the
+    // profile outlives the run - which is the one thing `nothing it opened outlives the
+    // run` promises. It passed on macOS and on an idle Linux box and failed on a loaded CI
+    // runner for four releases, which is exactly how a race behaves.
+    for (let i = 0; i < 40 && stillThere(pid); i++) waitSync(10);
   }
+  // Then remove it, and more than once. One rmSync is a snapshot; a file recreated a
+  // millisecond after the sweep began turns it into ENOTEMPTY and a leftover folder.
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    try {
+      fs.rmSync(home, { recursive: true, force: true });
+      return;
+    } catch {
+      waitSync(20);
+    }
+  }
+  // A profile left in the temporary folder is untidy, not harmful — and it is exactly what
+  // `staysfixed browsers --clean` is for.
+}
+
+/**
+ * Is that process still running? Signal 0 asks without sending anything.
+ * @param {number} pid
+ * @returns {boolean}
+ */
+function stillThere(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * A real sleep, in the one place nothing may be awaited: this runs inside
+ * `process.on('exit')`, where the event loop is already over and a promise never
+ * resolves. `Atomics.wait` is the only thing that actually pauses here.
+ *
+ * @param {number} ms
+ */
+function waitSync(ms) {
   try {
-    fs.rmSync(home, { recursive: true, force: true });
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
   } catch {
-    // A profile left in the temporary folder is untidy, not harmful.
+    // No SharedArrayBuffer here. Falling straight through is still better than throwing
+    // out of a cleanup handler.
   }
 }