staysfixed 0.9.1 → 0.10.0

package/CHANGELOG.md

@@ -8,6 +8,63 @@ numbers follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 Nothing yet.
 
+## [0.10.0] — 2026-08-31
+
+The night the four surfaces nobody had pointed it at were pointed at it, and the biggest
+remaining lie in the coverage ledger was closed.
+
+### Fixed — the ledger said things had been checked that had not
+
+- **Knocking counted as walking.** A door counted as walked because a step said it knocked on
+  it, whatever came back. So a route the source declares and the running build answers 404 to
+  was counted as covered — and behind a sign-in wall, where every request is bounced to
+  /login, every door in the product counted as walked and the run came back clean. What
+  answered was on the record all along. **404, 405, 410 and 501** now leave the door shut and
+  say that the source and the build disagree about whether it exists. **A redirect** is walked
+  — the bounce is real behaviour — but named as a bounce, and when every door that answered
+  did it, the run says so: that is what a sign-in wall looks like from outside. **A 500 is
+  still walked**, deliberately: the route exists and it broke, which is what a check is for.
+- **A product that never started was reported as twelve regressions.** A server that will not
+  boot produces a difference at every address it used to answer at, and not one of them said
+  the server had not started. The verdict leads with the cause now.
+- **A build older than its source passed as "nothing that worked has changed".** This tool
+  runs your product and never builds it, so `node dist/server.js` runs yesterday's build
+  against today's code and compares it against a reference cut from the same stale output. It
+  says so now. Following `npm run start` down into package.json is what made it fire at all.
+
+### Added — the headline feature actually runs
+
+- **Guards run on `staysfixed check`**, and over MCP, whenever the settings give an address to
+  open. A guard that fails becomes a finding **sealed by name**, which no agent may wave
+  through. Where there is no address to open it still says so, and names the one line that
+  would change it.
+
+### Fixed — it asked for what it had already been given
+
+- **`doctor` asked every adapter with an EMPTY config** unless the settings were JSON — and
+  `init` writes JavaScript. So on almost every project it asked for the very thing the
+  settings already named, and one sentence managed to say an app was present and missing at
+  once. It reads the few values it needs out of the text now, scoped per block, without
+  running anybody's code.
+- **`ios.app` was invisible**: the lookup only ever searched for `xcworkspace`, while this
+  tool's own advice says to name the built app under `ios.app`.
+
+### Fixed — noise that buried the news
+
+- **A bundler renames its output whenever the source changes**, so one edit produced four
+  extra findings, all of them chunk filenames, with the real change underneath. Normalised
+  inside a bundler's own asset paths only — a standalone content hash still changes and still
+  shows.
+- **On a monorepo `init` announced five products and wrote settings for one.** What is
+  announced and what is written now have to agree.
+
+### Still wrong, and written down rather than hidden
+
+- `init` still names a container folder (`packages/`) as a product on a workspaces monorepo.
+- An Electron check deadlocked once with no output and could not be reproduced.
+- The Windows surface is reachable and signed in but its screen is locked, so nothing can be
+  driven there yet.
+
 ## [0.9.1] — 2026-08-30
 
 Eleven more, from the same hunt that produced 0.9.0 — the findings it had already paid for.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "staysfixed",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Prove that what already worked still works after an agent changed the code. Picture checks, guards for fixed bugs, a pre-release walkthrough, and known-good markers — as a CLI and as an MCP server.",
   "type": "module",
   "license": "MIT",

package/src/v2/check.js

@@ -326,16 +326,38 @@ export async function check(options = {}) {
     // the word "guard" exactly zero times. A tool built to catch silent breakage must not do
     // nothing silently.
     const named = await guardNames(project.root);
-    if (named.length > 0 && verdict.coverage) {
-      verdict.coverage.gaps = [
-        ...(verdict.coverage.gaps ?? []),
-        {
-          what: `${named.length} guard${named.length === 1 ? '' : 's'} written against bugs that already happened once`,
-          why:
-            `They are sealed by name, so nothing touching one can be waved through quietly — but they were not RUN on this check. ` +
-            `\`staysfixed check --guards\` walks them. ${named.map((n) => `"${n}"`).join(', ')}`,
-        },
-      ];
+    if (named.length > 0) {
+      const walked = await walkTheGuards(project.root, options);
+      if (walked.ran) {
+        // A guard that failed is a bug somebody already had, coming back. It is sealed by
+        // name — one of the five classes no agent may wave through, whatever the reason.
+        for (const bad of walked.failed) {
+          verdict.findings = [
+            ...(verdict.findings ?? []),
+            /** @type {any} */ ({
+              id: `guard-${sha256(bad.name).slice(0, 6)}`,
+              title: `A bug that was already fixed is back: ${bad.name}`,
+              why: bad.message ?? 'The guard written for it does not hold any more.',
+              class: 'named guard',
+              guard: bad.name,
+              differences: [],
+              rank: 0,
+              count: 1,
+            }),
+          ];
+        }
+        verdict.summary = `${walked.said} ${verdict.summary}`;
+        if (walked.failed.length > 0) verdict.ok = false;
+      } else if (verdict.coverage) {
+        verdict.coverage.gaps = [
+          ...(verdict.coverage.gaps ?? []),
+          {
+            what: `${named.length} guard${named.length === 1 ? '' : 's'} written against bugs that already happened once`,
+            why: `They are sealed by name, so nothing touching one can be waved through quietly — but they were not RUN on this check: ${walked.why}`,
+            unlockedBy: 'Give the settings an address to open — `url` beside `start` in the `web` block, or `electron.binary` — and every check walks them from then on.',
+          },
+        ];
+      }
     }
 
     /** @type {CheckOutcome} */
@@ -471,6 +493,21 @@ async function settle(verdict, store, product, guards) {
           : `NOTHING WAS ACTUALLY COMPARED. Every journey was walked on the build you have, and not one of them had anything on record from the build you were happy with, so there was nothing to hold them against. This is not a pass and not a failure — it is no answer. ${verdict.summary}`;
     }
 
+    // THE CAUSE FIRST, when the cause is that the product never answered.
+    //
+    // A server that will not start produces a difference at every address it used to answer
+    // at — the content type gone, the body gone, "answered at all" arriving. Measured
+    // 2026-08-31 on a product whose start command throws: twelve findings, not one of them
+    // saying the server had not started, and a person reads "12 things behave differently"
+    // and goes looking for a regression in code that is fine. The symptoms are real and they
+    // belong in the list; they are just not the news.
+    const silent = didNotAnswer(verdict);
+    if (silent.length > 0) {
+      verdict.summary =
+        `THE PRODUCT DID NOT ANSWER. ${silent.length} ${silent.length === 1 ? 'way in was' : 'ways in were'} not tried at all — ${silent.slice(0, 3).join('; ')}${silent.length > 3 ? '; and more' : ''}. Most of what follows is that one fact wearing different clothes, not ${silent.length === 1 ? 'a separate change' : 'separate changes'}: fix the start and check again before reading any of it as a regression. ` +
+        verdict.summary;
+    }
+
     // And what was NOT looked at, in the same breath as the good news, on every run
     // including the clean ones. A green verdict on a product with three hundred doors
     // nobody has ever opened is true and it is not what it looks like, and the only place
@@ -659,6 +696,45 @@ function comparedNothing(verdict) {
   return nothingToCompare >= walked ? 'no stored record' : null;
 }
 
+/**
+ * Walk the guards, if this project can be opened.
+ *
+ * Guards are the headline of this whole product — one plain-English rule per bug somebody
+ * already had — and the default command never ran them. It said so, which was better than
+ * pretending, but saying it is not doing it. Version 1 knows how to drive an app and run
+ * them; what was missing was anybody calling it from here.
+ *
+ * It needs an address it can open. Where the settings only say how to START the product,
+ * that is version 2's job and this path cannot do it — so it says so instead, and names the
+ * one line that would change it.
+ *
+ * @param {string} root
+ * @param {any} options
+ * @returns {Promise<{ran: boolean, why: string, said: string, failed: {name: string, message?: string}[]}>}
+ */
+async function walkTheGuards(root, options) {
+  try {
+    const { loadProject } = await import('../core/config.js');
+    const { runCheck } = await import('../run.js');
+    const project = await loadProject({ cwd: root, configFile: options?.configFile });
+    const run = await runCheck(project, { guardsOnly: true, writeReport: false, quiet: true, signal: options?.signal });
+    const guards = run.guards ?? [];
+    const failed = guards.filter((g) => g.status === 'failed').map((g) => ({ name: g.name, message: g.message }));
+    const held = guards.length - failed.length;
+    return {
+      ran: true,
+      why: '',
+      said:
+        failed.length === 0
+          ? `All ${guards.length} guard${guards.length === 1 ? '' : 's'} still hold.`
+          : `${failed.length} of ${guards.length} guards failed — ${failed.length === 1 ? 'a bug' : 'bugs'} that ${failed.length === 1 ? 'was' : 'were'} already fixed ${failed.length === 1 ? 'is' : 'are'} back, and no agent may wave ${failed.length === 1 ? 'it' : 'them'} through. ${held} still hold.`,
+      failed,
+    };
+  } catch (e) {
+    return { ran: false, why: messageOf(e), said: '', failed: [] };
+  }
+}
+
 /**
  * The guards this project has, by name.
  *
@@ -681,6 +757,125 @@ export async function guardNames(root) {
   }
 }
 
+/**
+ * Is the thing that ran older than the code it was built from?
+ *
+ * This tool never builds anything — deliberately, because building somebody's project is not
+ * its business. But a project whose start command runs `dist/server.js` and whose source
+ * lives in `src/` will happily run YESTERDAY's build against today's source, compare it
+ * against a reference cut from the same stale output, and answer "Nothing that worked has
+ * changed" — about code it has never once executed. Measured 2026-08-31.
+ *
+ * It cannot be fixed by building; it can be SAID, which is all a coverage gap has to do.
+ *
+ * @param {string} root
+ * @param {any} config
+ * @returns {Promise<CoverageGap|null>}
+ */
+async function builtBeforeItsSource(root, config) {
+  try {
+    let pkg = {};
+    try {
+      pkg = JSON.parse(await fsp.readFile(path.join(root, 'package.json'), 'utf8'));
+    } catch {
+      return null;
+    }
+    const scripts = /** @type {any} */ (pkg).scripts ?? {};
+    // `npm run start` says nothing about where the product lives; the answer is one level
+    // down, in the script it runs. Following that indirection is the difference between this
+    // check firing and never firing, because `init` writes exactly `npm run start`.
+    const through = (/** @type {string} */ line) => {
+      const run = /(?:npm run|yarn|pnpm run|pnpm)\s+([\w:-]+)/.exec(line);
+      const named = run ? scripts[run[1]] : line.includes('npm start') ? scripts.start : null;
+      return `${line} ${typeof named === 'string' ? named : ''}`;
+    };
+    const starts = [
+      ...(config?.process?.commands ?? []).map((/** @type {any} */ c) => String(c?.run ?? '')),
+      String(config?.http?.start ?? ''),
+      String(config?.web?.start ?? ''),
+    ].map(through).join(' ');
+    const named = /\b(dist|build|out|lib)\b/.exec(starts);
+    const builds = typeof scripts.build === 'string';
+    if (!named || !builds) return null;
+
+    const outDir = path.join(root, named[1]);
+    const srcDir = path.join(root, 'src');
+    const [built, source] = await Promise.all([newestUnder(outDir), newestUnder(srcDir)]);
+    if (built === 0 || source === 0 || source <= built) return null;
+
+    const behind = Math.round((source - built) / 1000);
+    /** @param {number} n @param {string} unit */
+    const plural = (n, unit) => `${n} ${unit}${n === 1 ? '' : 's'}`;
+    const howLong =
+      behind > 86400 ? plural(Math.round(behind / 86400), 'day') : behind > 3600 ? plural(Math.round(behind / 3600), 'hour') : plural(Math.max(1, Math.round(behind / 60)), 'minute');
+    return {
+      what: `What ran is older than the code it was built from — \`${named[1]}/\` is ${howLong} behind \`src/\`.`,
+      why: `This tool runs your product, it never builds it. So the build in \`${named[1]}/\` is what was walked, and your newer source was not executed at all. A clean result here says nothing whatever about the code you have just written — and the reference it was compared against was cut from the same stale output.`,
+      unlockedBy: 'Run your build before the check — `npm run build && npx staysfixed check` — or put the build into the start command in your settings.',
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The newest modification time anywhere under a folder, or 0 if there is nothing there.
+ * @param {string} dir
+ * @returns {Promise<number>}
+ */
+async function newestUnder(dir) {
+  let newest = 0;
+  /** @param {string} at @param {number} depth */
+  const walk = async (at, depth) => {
+    if (depth > 6) return;
+    let entries = [];
+    try {
+      entries = await fsp.readdir(at, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+      const full = path.join(at, entry.name);
+      if (entry.isDirectory()) await walk(full, depth + 1);
+      else {
+        try {
+          const at2 = (await fsp.stat(full)).mtimeMs;
+          if (at2 > newest) newest = at2;
+        } catch {
+          // gone between the listing and the question
+        }
+      }
+    }
+  };
+  await walk(dir, 0);
+  return newest;
+}
+
+/**
+ * The ways into the product that were never tried, and why.
+ *
+ * A build that would not start does not produce one finding — it produces one at every
+ * address it used to answer at, and the real news is nowhere in the list.
+ *
+ * @param {CheckOutcome} verdict
+ * @returns {string[]}
+ */
+function didNotAnswer(verdict) {
+  /** @type {Set<string>} */
+  const said = new Set();
+  for (const finding of verdict.findings ?? []) {
+    for (const d of finding.differences ?? []) {
+      const path = String(d.path ?? '');
+      if (!path.endsWith('answered at all')) continue;
+      const name = path.split('.').slice(1, -1).join('.') || path;
+      const why = typeof d.candidate === 'string' ? d.candidate : typeof d.describe === 'string' ? d.describe : '';
+      said.add(why ? `${name} (${String(why).slice(0, 90)})` : name);
+    }
+  }
+  return [...said];
+}
+
 /**
  * Copies left behind by runs that never finished.
  *
@@ -1591,6 +1786,8 @@ async function openProject(options) {
       unlockedBy: `Fix package.json, or put the name you want in your settings file as product: '<name>'. Until then every comparison starts from nothing.`,
     });
   }
+  const stale = await builtBeforeItsSource(root, config);
+  if (stale) gaps.push(stale);
   if (storeTrouble.length > 0) {
     gaps.push({
       what: 'This run was NOT written down, so the next check has nothing from today to compare against.',

package/src/v2/coverage.js

@@ -101,6 +101,14 @@ import { listBuilds, listCaptures, loadCapture, referencePointer } from './store
  * @property {string[]} [doors]               Door keys the journey's steps name, for steps that
  *                                            named a door with nothing to tell apart from
  *                                            another of the same name. See doorKey.
+ * @property {{door: string, status: number}[]} [onlyRedirected]
+ *                                            Doors that answered with a redirect. Walked — the
+ *                                            bounce is real behaviour — but what is behind them
+ *                                            was never seen.
+ * @property {{door: string, status: number}[]} [knockedShut]
+ *                                            Doors a step knocked on where the running build
+ *                                            answered that they are not there. Knocking is not
+ *                                            walking, and these have proved nothing.
  * @property {string[]} [doorAddresses]       Full door addresses, for steps that were specific
  *                                            enough to build one. A route step knows its verb,
  *                                            and GET /x and POST /x are two doors that share a
@@ -401,6 +409,15 @@ export function addressesTouched(observations) {
   return { paths: [...paths], byChannel };
 }
 
+/**
+ * Answers that mean the door is not there in the build that ran.
+ *
+ * A 500 is deliberately NOT here: the route exists and it broke, which is a real difference
+ * and exactly what a check is for. These four are the codes that say the thing the source
+ * declares was never reachable, so nothing has been proved about it either way.
+ */
+const NOTHING_THERE = new Set([404, 405, 410, 501]);
+
 /**
  * A walk, built from one stored capture and, when it is to hand, the journey behind it.
  *
@@ -426,8 +443,55 @@ export function walkFromCapture(capture, journey) {
     // would report POST as walked too, which is the coverage ledger lying in the one direction
     // it must never lie in.
     const named = journey.steps.filter((s) => typeof s.door === 'string' && typeof s.kind === 'string');
-    const exact = named.filter((s) => typeof s.doorDetail === 'string' && s.doorDetail !== '');
-    const byName = named.filter((s) => typeof s.doorDetail !== 'string' || s.doorDetail === '');
+
+    // KNOCKING IS NOT WALKING.
+    //
+    // A door was counted as walked because a STEP said it knocked on it — whatever came back.
+    // So a route the source declares and the running build answers 404 counted as covered; and
+    // behind a login wall, where every request is bounced to /login, every door in the product
+    // counted as walked and the run came back clean. That is the coverage ledger lying in the
+    // one direction this file says it must never lie in.
+    //
+    // What answered is on the record: the http adapter writes `api.<door>.status`. A 404, 405,
+    // 410 or 501 means the thing the code declares is not there in the build that ran, so
+    // nothing was proved about it and it stays shut.
+    const answered = new Map();
+    for (const ob of capture.observations ?? []) {
+      const found = /^api\.(.+)\.status$/.exec(String(ob?.path ?? ''));
+      if (found) answered.set(found[1], Number(ob.value));
+    }
+    /** @type {{door: string, status: number}[]} */
+    const shut = [];
+    /** @type {{door: string, status: number}[]} */
+    const bounced = [];
+    /** @param {any} s @returns {boolean} */
+    const reallyWalked = (s) => {
+      // The door is the ROUTE (`/reports`); the observation is addressed by method and route
+      // together (`api.GET /reports.status`), because GET and POST on one path are two doors.
+      // Try the composite first and the bare name after, so both shapes of step are covered.
+      const keys = [
+        typeof s.doorDetail === 'string' && s.doorDetail ? `${s.doorDetail} ${s.door}` : null,
+        typeof s.method === 'string' && s.method ? `${s.method} ${s.door}` : null,
+        String(s.door),
+      ].filter(Boolean);
+      const key = keys.find((k) => answered.has(/** @type {string} */ (k)));
+      const code = key === undefined ? undefined : answered.get(/** @type {string} */ (key));
+      // A redirect is real behaviour and it IS walked — but what you saw is the bounce, not the
+      // thing behind it. Behind a login wall every door answers 302 to /login, and the run
+      // then reports full coverage of a product it never got into.
+      if (typeof code === 'number' && code >= 300 && code < 400) {
+        bounced.push({ door: String(key), status: code });
+        return true;
+      }
+      if (typeof code !== 'number' || !NOTHING_THERE.has(code)) return true;
+      shut.push({ door: String(key), status: code });
+      return false;
+    };
+
+    const exact = named.filter((s) => typeof s.doorDetail === 'string' && s.doorDetail !== '').filter(reallyWalked);
+    const byName = named.filter((s) => typeof s.doorDetail !== 'string' || s.doorDetail === '').filter(reallyWalked);
+    if (shut.length > 0) walk.knockedShut = shut;
+    if (bounced.length > 0) walk.onlyRedirected = bounced;
     if (byName.length > 0) walk.doors = byName.map((s) => doorKey({ kind: String(s.kind), name: String(s.door) }));
     if (exact.length > 0) {
       walk.doorAddresses = exact.map((s) =>
@@ -613,6 +677,27 @@ export function buildLedger(input) {
       `${cutFunctions} functions that really did run were cut from the coverage lists to keep them readable, so up to that many of the doors counted as never opened were in fact opened. This ledger undercounts, and it undercounts by no more than ${cutFunctions}.`,
     );
   }
+  // Named, never silently dropped. A route the code declares and the build answers 404 to is
+  // not a covered route and it is not an absent one either — it is a disagreement between the
+  // source and the thing that ran, and that is worth more than most differences.
+  /** @type {Map<string, number>} */
+  const shutDoors = new Map();
+  for (const { walk } of walks) for (const d of walk.knockedShut ?? []) shutDoors.set(d.door, d.status);
+  if (shutDoors.size > 0) {
+    const listed = [...shutDoors.entries()].slice(0, 6).map(([door, code]) => `${door} answered ${code}`).join(', ');
+    caveats.push(
+      `${shutDoors.size} ${shutDoors.size === 1 ? 'door the code declares was' : 'doors the code declares were'} knocked on and answered as not being there (${listed}${shutDoors.size > 6 ? ', and more' : ''}). Knocking is not walking: nothing has been proved about ${shutDoors.size === 1 ? 'it' : 'them'}, and the source and the build that ran disagree about whether ${shutDoors.size === 1 ? 'it exists' : 'they exist'}.`,
+    );
+  }
+  /** @type {Map<string, number>} */
+  const bouncedDoors = new Map();
+  for (const { walk } of walks) for (const d of walk.onlyRedirected ?? []) bouncedDoors.set(d.door, d.status);
+  if (bouncedDoors.size > 0) {
+    const all = bouncedDoors.size >= Math.max(1, opened);
+    caveats.push(
+      `${bouncedDoors.size} ${bouncedDoors.size === 1 ? 'door' : 'doors'} answered with a redirect rather than with ${bouncedDoors.size === 1 ? 'a page' : 'pages'} — ${[...bouncedDoors.entries()].slice(0, 5).map(([door, code]) => `${door} answered ${code}`).join(', ')}${bouncedDoors.size > 5 ? ', and more' : ''}. What was seen is the bounce, not what is behind it.${all ? ' EVERY door that answered did this, which is what a sign-in wall looks like from out here: this run has not been inside the product at all.' : ''}`,
+    );
+  }
   if (input.doors.length === 0) {
     caveats.push('No doors are known at all, so this ledger cannot say what is uncovered — which is not the same as there being nothing uncovered.');
   }

package/src/v2/doctor.js

@@ -900,6 +900,18 @@ async function phoneApps(root, configFile) {
     return found ? { where: found[1], how: `your settings name it under ${key}` } : null;
   };
 
+  /**
+   * A named key whose value has to look right, so one settings word cannot be mistaken for
+   * another block's.
+   * @param {string} key
+   * @param {(value: string) => boolean} looksRight
+   * @returns {FoundApp|null}
+   */
+  const namedPath = (key, looksRight) => {
+    const found = new RegExp(`["']?${key}["']?\\s*:\\s*["'\`]([^"'\`]+)["'\`]`).exec(settings);
+    return found && looksRight(found[1]) ? { where: found[1], how: `your settings name it under ${key}` } : null;
+  };
+
   /**
    * @param {string[]} folders
    * @param {(name: string) => boolean} wanted
@@ -933,6 +945,14 @@ async function phoneApps(root, configFile) {
       : null);
 
   const ios =
+    // `ios.app` FIRST, because that is the key the adapter reads and the key this very file
+    // tells people to write: "name the built .app in your settings under ios.app". It then
+    // looked only for `xcworkspace`, so a settings file naming a real built app was invisible
+    // and doctor answered "no iPhone app was found in this project, and the settings do not
+    // name one" about a project whose settings named one. Measured 2026-08-31 against a real
+    // TerminalDeck.app. The value has to end in `.app` so a bare `app:` belonging to some
+    // other block can never be mistaken for this one.
+    namedPath('app', (v) => v.endsWith('.app')) ??
     named('xcworkspace') ??
     built(['dist', 'out', 'build', 'release'], (name) => name.endsWith('.app')) ??
     (there(path.join('ios', 'Podfile')) || readdirSafe(path.join(root, 'ios')).some((n) => n.endsWith('.xcodeproj') || n.endsWith('.xcworkspace'))
@@ -1065,6 +1085,16 @@ async function askTheAdapters(root) {
     // Read as text and parsed only when it is JSON. Doctor never runs a person's code to
     // answer a question about their machine, and a settings file may be JavaScript.
     if (file && file.endsWith('.json')) config = JSON.parse(readFileSync(file, 'utf8'));
+    // But "not JSON" was being treated as "says nothing", and `init` writes JavaScript — so
+    // for almost every project every adapter was asked what it needs while being handed an
+    // EMPTY config. It then asked for the very thing the settings already named: a project
+    // whose settings pointed at a real built TerminalDeck.app was told, in one sentence,
+    // "the app is here. What is missing is a built iPhone app to check". Measured 2026-08-31.
+    //
+    // The few values the adapters need to answer honestly are read out of the TEXT instead,
+    // scoped to their own block so one block's `app` can never be read as another's. Still no
+    // code is run, which was the whole point of the rule.
+    else if (file) config = { ...config, ...settingsFromText(readFileSync(file, 'utf8')) };
   } catch {
     config = {};
   }
@@ -1384,6 +1414,54 @@ export function readHostProbe(name, alive, look) {
   return report;
 }
 
+/**
+ * The handful of settings an adapter needs to say what it is missing, read out of a
+ * JavaScript settings file WITHOUT running it.
+ *
+ * Scoped per block on purpose: `app` means one thing under `ios` and nothing under `web`, and
+ * a flat search would hand the wrong path to the wrong adapter.
+ *
+ * @param {string} text
+ * @returns {Record<string, any>}
+ */
+function settingsFromText(text) {
+  const clean = withoutComments(text);
+  /** @type {Record<string, any>} */
+  const out = {};
+  /** @type {Record<string, string[]>} */
+  const wanted = {
+    ios: ['app'],
+    android: ['apk', 'package'],
+    electron: ['binary'],
+    web: ['url', 'start'],
+    http: ['start', 'url'],
+  };
+  for (const [block, keys] of Object.entries(wanted)) {
+    const at = new RegExp(`["']?${block}["']?\\s*:\\s*\\{`).exec(clean);
+    if (!at) continue;
+    // The block's own text: from its brace to the matching one, counted rather than guessed,
+    // so a nested object cannot end the block early.
+    let depth = 0;
+    let end = at.index + at[0].length;
+    for (; end < clean.length; end += 1) {
+      if (clean[end] === '{') depth += 1;
+      else if (clean[end] === '}') {
+        if (depth === 0) break;
+        depth -= 1;
+      }
+    }
+    const inside = clean.slice(at.index + at[0].length, end);
+    /** @type {Record<string, string>} */
+    const found = {};
+    for (const key of keys) {
+      const hit = new RegExp(`["']?${key}["']?\\s*:\\s*["'\`]([^"'\`]+)["'\`]`).exec(inside);
+      if (hit) found[key] = hit[1];
+    }
+    if (Object.keys(found).length > 0) out[block] = found;
+  }
+  return out;
+}
+
 /**
  * Host names out of ~/.ssh/config. Patterns are skipped: `Host *` is a rule, not
  * a machine, and dialling it would be meaningless.
@@ -1704,7 +1782,14 @@ function describeSurfaces(tools, hosts, configured, browsers, desktopApp, driver
             ? 'Cannot run here: no usable iOS runtime was found, so there is no simulator to boot the app on.'
             : iosReady
               ? `Covered on the simulator, against the stored record. It boots ${phones.ios.where} on a simulator of its own and reads what each control on the screen is and does. A real iPhone in your hand cannot be compared side by side and never will be — two builds cannot exist on it at once.`
-              : `The simulator is here and the app is here. What is missing is ${plainList(iosWants.map((n) => n.what))}, so a clean result would cover less than it looks like.`,
+              : // "and the app is here" was said because a PATH was found, while the adapter was
+                // still asking for a built app — so one sentence claimed the app was present and
+                // missing at once. Measured 2026-08-31 on a settings file pointing at a
+                // TerminalDeck.app that turned out to be an empty folder left by an old build.
+                // A path is not a bundle, and only the adapter can tell the difference.
+                iosWants.some((n) => /built iPhone app/i.test(String(n.what)))
+                ? `The simulator is here and the settings name an app, but there is no built app bundle at that path — an empty folder from an old build looks exactly like this. What is missing is ${plainList(iosWants.map((n) => n.what))}.`
+                : `The simulator is here and the app is here. What is missing is ${plainList(iosWants.map((n) => n.what))}, so a clean result would cover less than it looks like.`,
     canCheck: iosReady || iosPartly ? [...withoutADriver, 'meaning', 'pixels'] : [],
     cannotCheck: iosReady || iosPartly ? [] : CHANNELS.map((c) => c.id),
     needs:

package/src/v2/init.js

@@ -1807,7 +1807,21 @@ export async function run(ctx) {
   }
 
   blank();
+  // What was ANNOUNCED and what was WRITTEN have to agree. On a workspaces monorepo this
+  // said "can be checked here now" about four things — including a folder that is only a
+  // container and holds no product at all — and then wrote one settings file describing one
+  // product. Measured 2026-08-31. Everything above is what was FOUND; this says what is
+  // actually covered, and how to cover the rest.
+  const others = (result.plan?.readiness ?? [])
+    .map((/** @type {any} */ r) => String(r.product ?? ''))
+    .filter((/** @type {string} */ n, /** @type {number} */ i, /** @type {string[]} */ all) => n !== '' && all.indexOf(n) === i);
   if (result.written.length > 0) ok(`Written: ${result.written.map((f) => shortPath(f)).join(', ')}`);
+  if (others.length > 1) {
+    warn(
+      `Those settings describe ONE product. ${others.length} were found here (${others.join(', ')}), and the others are not covered by this file. ` +
+        'Run `staysfixed init` from inside each of the others to give it its own settings, and check it from there.',
+    );
+  }
   if (result.kept.length > 0) warn(`Left exactly as it was: ${result.kept.map((f) => shortPath(f)).join(', ')}`);
   for (const problem of result.problems) fail(problem);
 

package/src/v2/normalise.js

@@ -114,6 +114,17 @@ export const DEFAULT_RULES = [
     pattern: '\\b[0-9a-fA-F]{16,31}\\b',
     with: '<hex>',
   },
+  {
+    id: 'asset.bundled',
+    kind: 'replace',
+    what: 'The hash in a bundler\'s own asset filename — /_next/static/chunks/main-9f2c1a.js, /assets/index-4b8e21.css, app.7d3f9a1c.js.',
+    why:
+      'A bundler renames its output whenever the source changes, so editing one line renames several files. Measured on a Next.js app: one source edit produced four extra findings, all of them chunk filenames, and the change a person actually made was underneath them. The rename is not news — the code change is, and that is reported on its own.',
+    wouldHide:
+      'A deliberate change to an asset filename, which nobody makes by hand. Deliberately narrow: the hash is only taken inside a path that a bundler owns, so a content hash anywhere else still changes and still shows — see id.hex, which leaves 32-and-longer hex alone for exactly that reason.',
+    pattern: '(/_next/static/[^"\'\\s]*?|/assets/[^"\'\\s]*?|\\b[\\w.-]+)[.-][0-9a-fA-F]{6,}(\\.(?:js|mjs|css|map))',
+    with: '$1.<asset>$2',
+  },
   {
     id: 'id.pid',
     kind: 'replace',