The listing found Safari's jar with `stat`, which TCC permits without Full
Disk Access, so Safari always listed as ready and the wizard opened on the
configure step — the permission-first flow, the "still required" recheck and
its `resume: "configure"` path could never run, and a refresh could not tell
granted from denied. `unavailableReason` now probes the jar by opening it for
read; TCC's EPERM reports `needsFullDiskAccess`, while a readable jar or any
other failure does not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>