staysfixed 0.9.1 → 0.11.0

package/src/v2/remote.js

@@ -39,6 +39,9 @@
 import { spawn } from 'node:child_process';
 import { StaysFixedError } from '../core/errors.js';
 import { howLongItTook, joinPath, notCovered, observation, sizeBucket, timeBucket, trimForStorage } from './adapters/contract.js';
+// Every wait here has a limit and every limit says what it was waiting for. One copy of that,
+// shared with the adapters, rather than one per file.
+import { boundedMs, letGoOf } from './adapters/process.js';
 
 /** @typedef {import('./types.js').Observation} Observation */
 /** @typedef {import('./types.js').Journey} Journey */
@@ -563,7 +566,17 @@ export function remoteRunner(opts) {
       // The program itself, on the first line of standard input, where no command-line limit
       // applies. See powerShellBootstrap for why this is not on the command line.
       proc.stdin.write(`${Buffer.from(agentSource, 'utf8').toString('base64')}\n`);
-      await hello;
+      try {
+        await hello;
+      } catch (e) {
+        // The handshake has a clock on it, but the ssh it was waiting for does not stop on its
+        // own — and while it lives, this process is reading its pipes, which keeps the event
+        // loop awake and stops the tool exiting long after it has given up and said so.
+        try { proc.kill('SIGKILL'); } catch { /* already gone */ }
+        letGoOf(proc);
+        child = null;
+        throw e;
+      }
       say(`${host} answered: ${describeFacts(facts)}`);
       return facts;
     },
@@ -584,7 +597,10 @@ export function remoteRunner(opts) {
       if (dead) throw dead;
       if (!child) throw new StaysFixedError(`Cannot talk to ${host} before opening the connection.`);
       const id = `r${++counter}`;
-      const timeoutMs = callOpts.timeoutMs ?? opts.callTimeoutMs ?? DEFAULT_CALL_MS;
+      // Guarded, so a limit that came out of a settings file as text cannot become NaN — which
+      // `setTimeout` reads as one millisecond and which would report every call on a perfectly
+      // healthy machine as "it did not answer".
+      const timeoutMs = boundedMs(callOpts.timeoutMs ?? opts.callTimeoutMs, DEFAULT_CALL_MS);
       const promise = new Promise((resolve, reject) => {
         const timer = setTimeout(() => {
           waiting.delete(id);
@@ -699,9 +715,14 @@ export function remoteRunner(opts) {
       try { proc.stdin.end(); } catch { /* nothing to end */ }
       await new Promise((resolve) => {
         const timer = setTimeout(() => { try { proc.kill(); } catch { /* gone */ } resolve(undefined); }, 3000);
-        proc.on('close', () => { clearTimeout(timer); resolve(undefined); });
+        // `exit` and not `close`: `close` means nobody anywhere is holding the pipes any more,
+        // which anything ssh left behind can refuse for ever. `exit` means ssh ended, which is
+        // the thing actually being waited for.
+        proc.on('exit', () => { clearTimeout(timer); resolve(undefined); });
         if (proc.exitCode !== null) { clearTimeout(timer); resolve(undefined); }
       });
+      // And let go of the pipes rather than trusting them to close on their own.
+      letGoOf(proc);
       child = null;
     },
   };

package/src/v2/run.js

@@ -23,7 +23,6 @@ import { createRequire } from 'node:module';
 import { makeEvents } from '../core/events.js';
 import { StaysFixedError, messageOf } from '../core/errors.js';
 import {
-  diffCaptures,
   findDuplicatePaths,
   measureWobble,
   mergeWobble,
@@ -33,8 +32,15 @@ import {
   indexByPath,
   wobbleStorm,
 } from './observation.js';
-import { ensureStore, saveBuild, saveCapture, latestCapture, referenceFor, listBuilds } from './store.js';
+// `diffCaptures` is no longer called from here directly. Everything goes through
+// `compareAnswers`, which is that same comparison with one rule around it: an address where
+// either side holds a refusal is not compared at all. Reaching past it would put the bug of
+// 2026-08-31 straight back — two refusals compared equal and a product that could not start
+// came back "Nothing that worked has changed".
+import { compareAnswers, answeredAnything, isAnswer, refusalsIn, whyNoAnswer } from './refusal.js';
+import { ensureStore, saveBuild, saveCapture, latestCapture, loadCapture, referenceFor, listBuilds } from './store.js';
 import { describeRuleChange } from './normalise.js';
+import { currentReference } from './reference.js';
 import { clusterDifferences } from './cluster.js';
 import { rankFindings } from './rank.js';
 
@@ -211,6 +217,17 @@ export async function runCheck(opts) {
 
   // 1 — what counts as working.
   const reference = await resolveReference(opts.store, opts.product, opts.against);
+
+  // WHICH captures of the reference build are the record.
+  //
+  // The store keeps every capture a build ever produced, and the reader took the NEWEST of
+  // them. So the moment somebody checked out the old commit and ran a check, the record the
+  // whole comparison rests on quietly moved to whatever that run happened to see. Only `ship`
+  // may decide what "working" means, and a record that drifts on its own is that rule leaking.
+  // The two captures blessed at ship time are already written down beside the cut; they are
+  // used when they are still there, and the newest is the fallback for a reference cut before
+  // this was recorded. Found by the identical-runs lane, 2026-08-31.
+  const blessedRuns = await blessedCapturePairs(opts.store, opts.product, reference);
   say({
     type: 'reference',
     at: events.elapsed(),
@@ -364,7 +381,7 @@ export async function runCheck(opts) {
           surface: journey.surface,
         });
       }
-      const stored = await storedReference(opts.store, reference.id, journey.name);
+      const stored = await storedReference(opts.store, reference.id, journey.name, blessedRuns.get(journey.name));
       for (const problem of stored.problems) {
         gaps.push({
           what: `Part of the old build's record of "${journey.describe || journey.name}" could not be read.`,
@@ -562,17 +579,115 @@ export async function runCheck(opts) {
     // every address the new build produced and read like a full comparison.
     /** @type {Set<string>} */
     const comparedAddresses = new Set();
+    // Addresses that could not be put side by side because one side of them is a refusal.
+    // Until 2026-08-31 there was no such list: a refusal was a value like any other, so two
+    // of them compared EQUAL and vanished into the silence that this tool reads as "nothing
+    // changed", while a refusal opposite a real value came back as a difference nobody
+    // caused. Both are now counted here and neither is a finding.
+    /** @type {import('./refusal.js').Uncompared[]} */
+    const uncompared = [];
+    // The same thing one level up: a whole walk that never got the product to say anything.
+    /** @type {string[]} */
+    const standardHasNoRecordOf = [];
+    /** @type {{journey: string, why: string}[]} */
+    const thisBuildWouldNotAnswer = [];
     for (const journey of journeys) {
       const was = before.get(journey.name);
       const is = walked.get(journey.name);
       if (!was || !is) continue;
-      for (const o of was.observations) comparedAddresses.add(`${journey.name} ${o.path}`);
-      for (const o of is.a.observations) comparedAddresses.add(`${journey.name} ${o.path}`);
-      raw.push(...diffCaptures(was, is.a));
+
+      // A WALK THAT ONLY EVER MET A REFUSAL IS NOT A SIDE OF A COMPARISON.
+      //
+      // Handled here as a whole rather than address by address because that is the shape it
+      // has. When the old build's record of a journey is nothing but refusals, EVERY address
+      // this build now answers at has nothing opposite it, so every one of them reports as
+      // having appeared out of nowhere: four findings on a two-journey fixture, thirteen on a
+      // three-route server, and the ones whose names say money or signing in land in a class
+      // no agent may wave through — so a phantom goes to a person and stays there. And the
+      // other way round is worse, not better: when THIS build is the one that would not
+      // answer, every address the old build had reports as vanished, and the real news — the
+      // product does not start — is nowhere in a list of forty findings. One sentence each,
+      // in the coverage list, is the honest form of both.
+      const standardAnswered = answeredAnything(was);
+      const thisBuildAnswered = answeredAnything(is.a);
+      if (!standardAnswered || !thisBuildAnswered) {
+        const name = journey.describe || journey.name;
+        if (!standardAnswered) standardHasNoRecordOf.push(name);
+        if (!thisBuildAnswered) {
+          const first = refusalsIn(is.a)[0];
+          thisBuildWouldNotAnswer.push({
+            journey: name,
+            why: first ? whyNoAnswer(first.value, first) : 'nothing it was asked answered.',
+          });
+        }
+        continue;
+      }
+
+      const compared = compareAnswers(was, is.a);
+      // Counted over answers only. The number goes into the closing sentence as "N addresses
+      // checked", and an address holding a refusal was never checked at anything.
+      for (const o of was.observations) if (isAnswer(o.value)) comparedAddresses.add(`${journey.name} ${o.path}`);
+      for (const o of is.a.observations) if (isAnswer(o.value)) comparedAddresses.add(`${journey.name} ${o.path}`);
+      raw.push(...compared.differences);
+      uncompared.push(...compared.uncompared);
+    }
+
+    // What the refusals cost, said in the coverage list where nothing is allowed to be
+    // skimmed past. Grouped by journey and by which side was missing, because one line per
+    // address on a product with a dead surface is a wall nobody reads.
+    const lost = uncompared.filter((u) => u.kind === 'lost');
+    const recovered = uncompared.filter((u) => u.kind === 'recovered');
+    const neverAnswered = uncompared.filter((u) => u.kind === 'never-answered');
+    for (const [kind, list] of /** @type {const} */ ([['lost', lost], ['recovered', recovered], ['never-answered', neverAnswered]])) {
+      if (list.length === 0) continue;
+      const names = unique(list.map((u) => u.journey ?? '')).filter(Boolean);
+      const where = names.length > 0 ? ` in ${names.slice(0, 4).join(', ')}${names.length > 4 ? ', and more' : ''}` : '';
+      const some = list.slice(0, 4).map((u) => u.path).join(', ');
+      const andMore = list.length > 4 ? `, and ${list.length - 4} more` : '';
+      if (kind === 'lost') {
+        gaps.push({
+          what: `${list.length} ${plural(list.length, 'address', 'addresses')} the old build answers at could not be answered by this build${where}, so ${plural(list.length, 'it was', 'they were')} not compared: ${some}${andMore}.`,
+          why: `${list[0].why} An address that used to be checked and cannot be now is coverage this build has taken away. It is not reported as a difference, because there is no answer here to differ from — but it is not a pass either.`,
+          unlockedBy: 'Get the product answering there again and run the check. Until then nothing about those addresses is being watched.',
+        });
+      } else if (kind === 'recovered') {
+        gaps.push({
+          what: `${list.length} ${plural(list.length, 'address', 'addresses')} this build answers at ${plural(list.length, 'has', 'have')} no answer in the standard${where}, so ${plural(list.length, 'it was', 'they were')} not compared: ${some}${andMore}.`,
+          why: `The build on record as working never answered here — ${list[0].why} There is nothing to hold today's answer against, so this is new coverage rather than a change. It used to arrive as a difference nobody caused.`,
+          unlockedBy: 'Ship once from a run that saw these, and from then on they are part of what "working" means and are compared like everything else.',
+        });
+      } else {
+        gaps.push({
+          what: `${list.length} ${plural(list.length, 'address', 'addresses')} answered on neither build${where}, so nothing was compared there: ${some}${andMore}.`,
+          why: `${list[0].why} Two refusals used to compare equal, which read exactly like two matching answers and counted towards "nothing has changed". They are counted here instead.`,
+          unlockedBy: 'Make the product answerable there — supply what the adapter said was missing — and these start being watched.',
+        });
+      }
     }
+    if (standardHasNoRecordOf.length > 0) {
+      gaps.push({
+        what: `${standardHasNoRecordOf.length} ${plural(standardHasNoRecordOf.length, 'journey', 'journeys')} could not be compared, because the build on record as working never got the product to do anything there: ${standardHasNoRecordOf.join(', ')}.`,
+        why: 'Everything this build did on those journeys is new coverage, not a change: there is nothing on the old build\'s side of it. Reported as findings until 2026-08-31, which is how a product that started working came back as a pile of regressions nobody had caused.',
+        unlockedBy: 'Ship once from a run in which these journeys actually ran, and they become part of what "working" means.',
+      });
+    }
+    for (const dead of thisBuildWouldNotAnswer) {
+      gaps.push({
+        what: `"${dead.journey}" was not compared: this build never got the product to do anything there.`,
+        why: `${dead.why} The old build has a record of what this journey does and this build has none, so there is nothing to compare — which is not the same as nothing having changed, and is not a pass.`,
+        unlockedBy: 'Run that one journey on its own and see what stops it. Nothing behind it is being watched until it runs.',
+      });
+    }
+    // The two build ids, because whether they are the SAME build decides whether any of this
+    // can be a change at all. When nothing has been edited they match, the stored record of
+    // "the old build" is the previous check's own run out of that build's folder, and every
+    // flicker between the two runs used to be reported as a change nobody asked for. See the
+    // long note on subtractWobble: it files them as this build arguing with itself instead.
     const subtraction = subtractWobble(raw, wobble, {
       referenceWobble: referenceWobbles.length > 0 ? mergeWobble(referenceWobbles) : undefined,
       steadyInReference: referenceWobbleMeasured && steadyInReference.length > 0 ? steadyInReference : undefined,
+      referenceBuildId: reference.id,
+      candidateBuildId: opts.candidate.id,
     });
     say({
       type: 'suspicion',
@@ -665,8 +780,31 @@ export async function runCheck(opts) {
     const warning = modeWarning(mode, provedLive, reference);
     if (warning) gaps.push(...warningGaps(mode, provedLive));
 
+    // COVERAGE THIS BUILD TOOK AWAY IS NOT A PASS. An address the standard answers at and
+    // this build cannot is not a difference — there is no answer here to differ from — so it
+    // produces no finding, and before this it produced nothing at all: the run came back
+    // `ok: true` with the hole three paragraphs down in the coverage list. `recovered` and
+    // `never-answered` deliberately do NOT come in here. One is good news and the other was
+    // already true of the build on record, and neither is something this change caused.
+    const answersLost = lost.length + thisBuildWouldNotAnswer.length;
+    // BY NAME, not by adding two lists. A journey where NEITHER side reached the product is
+    // in both lists, and subtracting both counts took it off the compared total twice — one
+    // journey compared out of two came out as nought of two, which is a different and worse
+    // claim than the true one.
+    const notReallyCompared = new Set([...standardHasNoRecordOf, ...thisBuildWouldNotAnswer.map((d) => d.journey)]);
     return finish(opts, {
-      ok: ranked.findings.length === 0 && subtraction.newlyUnstable.length === 0 && subtraction.couldNotTell !== true,
+      ok:
+        ranked.findings.length === 0 &&
+        subtraction.newlyUnstable.length === 0 &&
+        subtraction.couldNotTell !== true &&
+        answersLost === 0 &&
+        // AND SOMETHING HAS TO HAVE BEEN COMPARED. There is already a branch above for the
+        // case where no journey had an old-build side at all; this is the same law one notch
+        // finer, for the run where every journey HAD a record and every address in it holds
+        // a refusal on one side or the other. Measured 2026-08-31: a product fixed after a
+        // reference had been cut from a crash came back with nought findings, nought
+        // addresses compared, and `ok: true`.
+        comparedAddresses.size > 0,
       mode,
       modeWarning: warning,
       reference,
@@ -678,9 +816,15 @@ export async function runCheck(opts) {
       summary:
         (subtraction.couldNotTell === true ? `NO ANSWER FROM THIS RUN. ${subtraction.couldNotTellWhy} ` : '') +
         summarise(ranked.findings, subtraction, warning, [...runNotes, ...ranked.notes], reference, provedLive, dropped, {
-          compared: comparedJourneys.length,
+          compared: comparedJourneys.length - notReallyCompared.size,
           asked: journeys.length,
           addresses: comparedAddresses.size,
+          // The headline has to carry this. "Nothing that worked has changed" beside a
+          // hundred addresses that could not be answered is a sentence somebody stops
+          // reading after, and the whole reason two refusals comparing equal went unnoticed
+          // for as long as it did is that the silence looked exactly like agreement.
+          unanswered: uncompared.length,
+          lost: answersLost,
         }),
       startedAt,
       started,
@@ -754,6 +898,55 @@ function namesBuild(build, wanted) {
   return false;
 }
 
+/**
+ * The two captures `ship` blessed, per journey.
+ *
+ * Empty when there is no cut record — a reference set before this was written down, or one
+ * pointed at by hand — and the caller falls back to the newest capture, which is what every
+ * run did before.
+ *
+ * @param {Store} store
+ * @param {string} product
+ * @param {BuildFingerprint|null} reference
+ * @returns {Promise<Map<string, [string, string]>>}
+ */
+async function blessedCapturePairs(store, product, reference) {
+  /** @type {Map<string, [string, string]>} */
+  const out = new Map();
+  if (!reference?.id) return out;
+  try {
+    const current = await currentReference(store, product);
+    if (!current?.cut || current.cut.buildId !== reference.id) return out;
+    for (const journey of current.cut.stability?.byJourney ?? []) {
+      if (journey.runs && journey.runs.length === 2) out.set(journey.journey, journey.runs);
+    }
+  } catch {
+    // A reference log that cannot be read is somebody else's problem to report. Falling back
+    // to the newest capture keeps the check running, which is the honest degradation.
+  }
+  return out;
+}
+
+/**
+ * One capture by its id, or null when it is no longer there.
+ *
+ * @param {Store} store
+ * @param {string} buildId
+ * @param {string} journey
+ * @param {string} id
+ * @param {(m: string) => void} onProblem
+ * @returns {Promise<Capture|null>}
+ */
+async function captureById(store, buildId, journey, id, onProblem) {
+  if (!id) return null;
+  try {
+    return await loadCapture(store, { buildId, journey, captureId: id });
+  } catch (e) {
+    onProblem(`The capture ${id}, which is part of what this product calls working, could not be read. ${messageOf(e)}`);
+    return null;
+  }
+}
+
 /**
  * The reference build's stored record for one journey, and how steady it was.
  *
@@ -764,13 +957,28 @@ function namesBuild(build, wanted) {
  * @param {Store} store
  * @param {string} buildId
  * @param {string} journey
+ * @param {[string, string]} [blessed]  The two captures `ship` blessed, when it wrote them down.
  * @returns {Promise<{capture: Capture|null, wobble: Wobble|null, problems: string[]}>}
  */
-async function storedReference(store, buildId, journey) {
+export async function storedReference(store, buildId, journey, blessed) {
   /** @type {string[]} */
   const problems = [];
   /** @param {string} m */
   const onProblem = (m) => problems.push(m);
+  // The blessed pair first. These are the captures that were the product's definition of
+  // working at the moment somebody shipped, and nothing since may replace them.
+  if (blessed) {
+    const pinnedA = await captureById(store, buildId, journey, blessed[0], onProblem);
+    const pinnedB = await captureById(store, buildId, journey, blessed[1], onProblem);
+    if (pinnedA) {
+      if (!pinnedB || pinnedB.id === pinnedA.id) return { capture: pinnedA, wobble: null, problems };
+      try {
+        return { capture: pinnedA, wobble: measureWobble(pinnedA, pinnedB), problems };
+      } catch {
+        return { capture: pinnedA, wobble: null, problems };
+      }
+    }
+  }
   const a =
     (await latestCapture(store, { buildId, journey, run: 'a', onProblem })) ??
     (await latestCapture(store, { buildId, journey, onProblem }));
@@ -898,13 +1106,23 @@ export function proveAgainstLive(suspicions, live, now) {
     // `observation()` in adapters/contract.js turns `covered: false` into `meta.refused`.
     // Filtering on `o.covered` therefore matched everything and did nothing at all — the
     // fix above was written correctly and then read the wrong field.
-    const walked = capture.observations.filter((o) => o.meta?.refused !== true);
+    //
+    // The test is now the VALUE rather than `meta.refused`, and the two are not the same
+    // thing. `meta.refused` is also set on an observation holding a real value that was only
+    // partly read — a stdout too big to keep whole is still an answer, and filtering it out
+    // here threw away a comparison that works perfectly well. What has to go is an
+    // observation with no answer in it at all.
+    const walked = capture.observations.filter((o) => isAnswer(o.value));
     if (walked.length === 0) continue;
     liveIndex.set(name, indexByPath(walked));
   }
   /** @type {Map<string, Map<string, Observation>>} */
   const nowIndex = new Map();
-  for (const [name, pair] of now) nowIndex.set(name, indexByPath(pair.a.observations));
+  // Answers only on this side too. Without it, an address the new build now refuses at came
+  // back from the expensive proof stamped `proven: true` with the words "not checked" in it
+  // as its candidate value — a refusal dressed as a re-verified regression, which is the
+  // strongest claim this tool can make about anything.
+  for (const [name, pair] of now) nowIndex.set(name, indexByPath(pair.a.observations.filter((o) => isAnswer(o.value))));
 
   /** @type {Difference[]} */
   const kept = [];
@@ -922,6 +1140,32 @@ export function proveAgainstLive(suspicions, live, now) {
     if (!was && !is) continue;
     if (was && is && sameValue(was.value, is.value)) continue;
     if (!was && is) {
+      // AN ADDRESS THE RECORD HOLDS A VALUE FOR IS NEVER "was not there before".
+      //
+      // A live walk of the old build answering DIFFERENTLY from its own record is drift, and
+      // subtracting it is the whole reason this function exists. A live walk that does not
+      // answer at that address AT ALL is not drift — it is the booted build failing to
+      // reproduce its own record, and the two are not the same news.
+      //
+      // Measured 2026-08-31 on a Node API. `ship` cut the reference from a working tree with
+      // uncommitted changes and said so; the record was filed under the build fingerprint of
+      // the tree that was actually walked, `work-76ac0155c8b9`, and it holds
+      // `api.GET /api/session.shape` with the value `{"token":"string"}` on disk. `bootReference`
+      // then fetched "the old build" by a DIFFERENT key off the same reference object — its
+      // `gitSha` — and `git archive` of that commit has no `/api/session` route in it at all,
+      // so nothing was observed at that address. This branch then threw the recorded value
+      // away and the run printed: `"GET /api/session / shape" is there now and was not before.`
+      // The record was sitting in the repository saying the opposite, and the difference was
+      // stamped `proven: true` on top, which the summary reads out as re-checked against the
+      // old build. A confident sentence, contradicted by this tool's own evidence.
+      //
+      // So the record wins where the live walk is silent: the difference keeps the values it
+      // came in with and goes back unproven, which is what the tool already says for every
+      // journey the old build could not walk.
+      if (d.reference !== undefined) {
+        kept.push({ ...d, proven: false });
+        continue;
+      }
       kept.push({ ...d, kind: 'appeared', reference: undefined, candidate: is.value, proven: true });
       continue;
     }
@@ -1060,9 +1304,10 @@ function warningGaps(mode, provedLive) {
  * @param {BuildFingerprint} reference
  * @param {boolean} provedLive
  * @param {number} dropped   Suspicions the old build turned out to have as well.
- * @param {{compared: number, asked: number, addresses: number}} how   How much of the run
- *   this sentence covers: journeys that had an old-build side, journeys asked for, and the
- *   addresses really put side by side.
+ * @param {{compared: number, asked: number, addresses: number, unanswered?: number, lost?: number}} how
+ *   How much of the run this sentence covers: journeys that were really put beside the old
+ *   build, journeys asked for, the addresses really compared, and the addresses that could
+ *   not be compared because one side of them was a refusal rather than an answer.
  * @returns {string}
  */
 function summarise(findings, subtraction, warning, notes, reference, provedLive, dropped, how) {
@@ -1076,7 +1321,17 @@ function summarise(findings, subtraction, warning, notes, reference, provedLive,
     missed > 0
       ? ` ${how.compared} of ${how.asked} journeys had anything on the old build's side to be compared against; the other ${missed} ${plural(missed, 'was', 'were')} not compared at all, and ${plural(missed, 'is', 'are')} named in the coverage list.`
       : '';
-  if (findings.length === 0 && subtraction.newlyUnstable.length > 0) {
+  if (subtraction.sameBuild === true) {
+    // The first sentence is the only one some readers get, so it may not be "Nothing that
+    // worked has changed. N addresses checked against the stored record of 1.0.0" when the
+    // record and the run are the same build. Nothing was held against anything: the tool ran
+    // the shipped build again and compared it with itself. Measured 2026-08-31 on an untouched
+    // Next.js app, where that sentence sat on top of a comparison that had no other side.
+    parts.push(
+      `This is the build that is already on record as working, run again and compared with itself, so nothing here could be a change. ` +
+        `${how.addresses} ${plural(how.addresses, 'address was', 'addresses were')} watched.${reach}`,
+    );
+  } else if (findings.length === 0 && subtraction.newlyUnstable.length > 0) {
     // Findings and newly unpredictable addresses are two different lists, and only the first
     // one was ever in the headline. A run with no findings and four addresses that have
     // stopped sitting still opened with "Nothing that worked has changed", which is the
@@ -1088,6 +1343,22 @@ function summarise(findings, subtraction, warning, notes, reference, provedLive,
       `Nothing behaves differently, but ${n} ${plural(n, 'address', 'addresses')} that used to give the same answer every time ${plural(n, 'does', 'do')} not any more. ` +
         `That is a change too: something is now unpredictable that was not. ${how.addresses} ${plural(how.addresses, 'address was', 'addresses were')} compared against ${against}.${reach}`,
     );
+  } else if (findings.length === 0 && how.addresses === 0) {
+    // Nought compared is never a pass. "Nothing that worked has changed. 0 addresses
+    // checked" is the exact sentence measured on 2026-08-31 over a product that threw on its
+    // first line, and it is arithmetically true and completely false as an answer.
+    parts.push(
+      `NO ANSWER FROM THIS RUN. Not one address could be put beside ${against}: every one of them holds a refusal on one side or the other, so nothing at all was compared. This is not a pass and not a failure.${reach}`,
+    );
+  } else if (findings.length === 0 && (how.lost ?? 0) > 0) {
+    // The all-clear may not be said over coverage this build took away. It is not a finding
+    // — there is no answer here to differ from — and until 2026-08-31 that made it nothing
+    // at all: the headline read "Nothing that worked has changed" and the hole sat three
+    // paragraphs down in a list.
+    const n = how.lost ?? 0;
+    parts.push(
+      `Nothing that COULD be compared has changed — but ${n} ${plural(n, 'address', 'addresses')} the old build answers at could not be answered by this build at all, so ${plural(n, 'it was', 'they were')} not compared. That is coverage this build has taken away, and it is not a pass. ${how.addresses} ${plural(how.addresses, 'address was', 'addresses were')} really put beside ${against}.${reach}`,
+    );
   } else if (findings.length === 0) {
     parts.push(`Nothing that worked has changed. ${how.addresses} ${plural(how.addresses, 'address', 'addresses')} checked against ${against}.${reach}`);
   } else {
@@ -1098,6 +1369,20 @@ function summarise(findings, subtraction, warning, notes, reference, provedLive,
         reach,
     );
   }
+  // Said in the same breath as the headline, never further down. A refusal is not an answer,
+  // so an address holding one was not checked at all — and until 2026-08-31 two of them
+  // compared equal, which is silence, which reads exactly like agreement. This sentence is
+  // what makes the difference visible to somebody who reads one line.
+  const unanswered = how.unanswered ?? 0;
+  if (unanswered > 0) {
+    const lostCount = how.lost ?? 0;
+    parts.push(
+      `${unanswered} ${plural(unanswered, 'address', 'addresses')} could not be compared at all, because one side of ${plural(unanswered, 'it', 'them')} is a refusal rather than an answer` +
+        (lostCount > 0
+          ? `, and ${lostCount} of ${plural(unanswered, 'those is', 'those are')} coverage this build has taken away — the old build answers there and this one does not.`
+          : '. Nothing about them is being watched, and none of them is a finding.'),
+    );
+  }
   parts.push(subtraction.note);
   if (dropped > 0) {
     parts.push(
@@ -1298,7 +1583,12 @@ function touchMap(walked) {
  */
 function steadyPaths(capture, wobble) {
   const unstable = new Set(wobble.unstable);
-  return capture.observations.map((o) => o.path).filter((p) => !unstable.has(p));
+  // Answers only. An address that held a refusal on both runs is not an address the build
+  // answered the same way twice; it is an address the build was never able to answer, and
+  // counting it as steady is the same mistake in miniature that let `ship` print "all 7
+  // addresses it was watched at answered the same way twice" about a product that threw on
+  // its first line (measured 2026-08-31).
+  return capture.observations.filter((o) => isAnswer(o.value)).map((o) => o.path).filter((p) => !unstable.has(p));
 }
 
 /**

package/src/v2/sealed.js

@@ -299,11 +299,21 @@ export function classify(finding, opts = {}) {
  * The refusal, written out for whoever reads it — an agent that has just been told no, or a
  * person reading the closing summary.
  *
+ * The verdict is identical either way; only the last line moves. It used to read "No agent
+ * can wave this through … put it in front of a person", which is exactly right for an agent
+ * and says nothing to the person who has just typed `staysfixed waive` themselves — they ARE
+ * the person it points at, and the sentence reads as a rule about somebody else with an
+ * obvious loophole. The rule has no loophole: a sealed class is refused to everybody, and
+ * from 2026-08-31, when `waive` became a command, it has had to say so to both readers.
+ *
  * @param {SealedVerdict} verdict
  * @param {Finding} [finding]
+ * @param {'agent'|'person'} [audience]  Defaults to an agent: this file is called from the
+ *                                       gate, and the gate is reached over MCP unless the
+ *                                       command line says otherwise.
  * @returns {string}
  */
-export function sayRefusal(verdict, finding) {
+export function sayRefusal(verdict, finding, audience) {
   const lines = [`Refused. ${verdict.why}`];
   if (finding?.title) lines.push(`  ${trim(finding.title, 200)}`);
   if (verdict.matched.length > 0) {
@@ -311,7 +321,9 @@ export function sayRefusal(verdict, finding) {
   }
   lines.push(
     '',
-    'No agent can wave this through, whatever the reason, and asking again in different words will get the same answer. Fix it, or put it in front of a person and say plainly what changed.'
+    audience === 'person'
+      ? 'Nothing can wave this through — not you here, and not an agent — and asking again in different words will get the same answer. Fix it, or take it to whoever owns this and say plainly what changed.'
+      : 'No agent can wave this through, whatever the reason, and asking again in different words will get the same answer. Fix it, or put it in front of a person and say plainly what changed.'
   );
   return lines.join('\n');
 }