Safety tiers & safe actions
Every verdict carries a safety tier and, at most, one suggested action Anomalous is confident is safe — or none at all. It never proposes something destructive on a guess.
The status pills
Every diagnosis card carries a single status pill so you can read the situation before you read a word:
means the process is understood and the suggested action carries no real risk, means something warrants a closer look before you act, and means Anomalous is telling you what it sees but is not asking you to do anything. The pill is the short answer to "should I worry?" The rest of the card is the long answer.The pill is never decoration. It is the surface of the card's safety tier, and it decides whether you get a button to press or only an explanation to read.
Under the hood
The pill reflects the card's safety_tier field, which is set when the diagnosis is composed from a curated corpus entry or an on-device model answer. A card only reaches you at all when its confidence score is high (>= 0.8); medium and low findings are retained quietly in a transparency panel and never become a pill or a notification (JudgmentCore.swift:141-145, AppState.swift:744-775).
Safety tiers explained
A safety tier is Anomalous's rating of how dangerous it would be to act on a card. The tiers run from "one safe thing you can do right now" up through "look first" to "explanation only, no button." The rating is deliberately conservative: the app would rather show you a tier that only explains than hand you a button it is not sure about.
Tiers are tied to identity, not guesswork. When Anomalous knows exactly what a process is, from its built-in reviewed knowledge or from a bundle-anchored on-device model answer, it can assign a confident tier. When it does not know what a process is, the tier drops to explain-only by default, because a confident wrong action is worse than an honest "I am not sure."
Under the hood
The offered action is derived purely from the tier: ProcessAction.offered(tier:kind:isApp:) returns a real button only for the safe tier and returns .explainOnly for everything else (ProcessAction.swift:36-42). A genuinely unknown daemon, one with no corpus entry and no application bundle id to anchor a model, is routed to a conservative "unknown, tier 3" card and never sent to the model to have an identity invented for it (JudgmentEngine.swift:68-77).
What a suggested action means
When a card does carry an action, there is at most one, and it is the single thing Anomalous is confident is safe. In practice that is a graceful Quit, a Restart for an app that leaked memory, a Force Quit for something frozen, or a brew services stop for a background service that belongs to Homebrew. Anomalous never offers a destructive action on a guess, and it never chains several actions together, because a menu-bar app that fires five buttons for one event is a nuisance.
"Quit" is polite: it asks the process to shut down cleanly. "Force Quit" is the harder stop, reserved for a hung or Not Responding app that cannot answer politely. If the misbehaving process is owned by the system rather than by you, Anomalous will not kill it for you at all; it shows you a copy-paste command instead so you stay in control.
Under the hood
A graceful Quit sends SIGTERM; SIGKILL is only ever sent when you explicitly force the stop. Before either signal, the actuator re-reads the live process start time and compares it to the flagged identity, so if the pid has been reused by a different process in the meantime the kill is refused (identityChanged) rather than sent to a stranger (ProcessAction.swift:63-81). Root-owned processes are terminated through a small privileged helper if one is installed; otherwise the card surfaces sudo killall <name> for you to run yourself (AppState.swift:1566-1574).
When Anomalous offers no action
Often the honest answer to "what should I do?" is "nothing you should do automatically," and Anomalous says so by showing a card with no button. This happens for anything above the safe tier, for a process it cannot confidently identify, and for special cases where acting would be wrong. For example, when kernel_task is using a lot of CPU the card reframes it as "your Mac is hot," because kernel_task is macOS deliberately throttling heat and killing it is neither possible nor desirable.
No button is not a dead end. The card still tells you what the process is, whether this is normal for it, and why it is likely behaving this way, so you can decide what to do with full context. You can also escalate a genuinely puzzling card to paid cloud triage with the "Get Help" button, which only ever runs when you tap it.
Under the hood
The routing function classifies each anomaly as thermal (kernel_task), hung app, deterministic unknown, or model-grounded, and only the last two ever produce a card that might carry a safe action (JudgmentEngine.swift:68-100). A hung app gets a deterministic force-quit-and-relaunch card without consulting any model at all.
Explain-only mode
Explain-only mode is the tier where Anomalous describes and does not act. It is the default whenever the app is not certain the action would be safe: the process is a mystery, the situation is a Caution, or the thing simply should not be touched. You get the identity, the numbers, the normal-versus-abnormal verdict, and the likely cause, and you keep the decision.
This is the deliberate posture of the whole product. Anomalous only speaks about anomalies it has verified, and it fails safe to "unknown" rather than fabricate a confident answer. An explain-only card is Anomalous choosing an honest shrug over a risky guess, which is exactly what makes the buttons it does offer worth trusting.
For how a card figures out what a process even is before it decides which tier applies, see Process lookup and diagnosis; for how a process earns a flag in the first place, see Why something gets flagged.