diff --git a/launch.sh b/launch.sh
index 0ef06b7..8861cc4 100755
--- a/launch.sh
+++ b/launch.sh
@@ -38,19 +38,10 @@ fi
 # Must name the browser the EXTENSION is loaded into. ultra = Brave, m3ultra = Chrome.
 BROWSER="${FLOW_BROWSER:-Brave Browser}"
 
-# A LOCKED SCREEN wedges every AppleScript window/tab query for ~2 min, then -1712
-# "AppleEvent timed out". Not a browser bug: with the screen locked, Finder, System Events
-# and Brave all hang on `count of windows` identically. Bail out loudly instead.
-if ioreg -n Root -d1 -r | tr -d ' ' | grep -q '"CGSSessionScreenIsLocked"=Yes'; then
-  echo "screen is LOCKED on $(hostname -s) — cannot drive $BROWSER (every window query would" \
-       "hang, then -1712). Unlock it; for an unattended rig also set System Settings >" \
-       "Lock Screen > 'Require password after screen saver begins' = Never."
-  exit 0   # not an error: the 10-min tick retries once someone unlocks
-fi
-
 # `open location` hands the URL to the DEFAULT browser (Brave here) — never to $BROWSER.
-# Make the tab inside the target app instead. Timeout so a wedged app can't hold the job.
-osascript <<OSA
+# Make the tab inside the target app instead. Timeout so a wedged app can't hold the job:
+# an Automation denial surfaces as a ~2min hang then -1712, NOT as a clean -1743.
+if out=$(osascript <<OSA 2>&1
 with timeout of 30 seconds
   tell application "$BROWSER"
     set found to false
@@ -73,4 +64,23 @@ with timeout of 30 seconds
   end tell
 end timeout
 OSA
-echo "$BROWSER focused on Flow. With Auto-start ticked, the rinse begins on load."
+); then
+  echo "$BROWSER focused on Flow. With Auto-start ticked, the rinse begins on load."
+else
+  # Don't guess. The TCC row for (this launchd job's /bin/sh) -> (this browser) says which it is.
+  echo "cannot drive $BROWSER: $out"
+  BUNDLE=$(osascript -e "id of app \"$BROWSER\"" 2>/dev/null)   # no AppleEvent — reads the bundle
+  DB="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+  AUTH=$(sqlite3 "$DB" "select auth_value from access where service='kTCCServiceAppleEvents'
+                        and client='/bin/sh' and indirect_object_identifier='$BUNDLE';" 2>/dev/null)
+  case "$AUTH" in
+    0) echo "  → Automation is DENIED for /bin/sh -> $BUNDLE (someone clicked Don't Allow)." \
+            "Fix: System Settings > Privacy & Security > Automation > sh > enable \"$BROWSER\"." ;;
+    2) echo "  → Automation is ALLOWED, so $BROWSER itself is not answering AppleEvents." \
+            "Screen locked? $(ioreg -n Root -d1 -r | tr -d ' ' | grep -q '"CGSSessionScreenIsLocked"=Yes' \
+              && echo yes || echo no). Try quitting and reopening $BROWSER." ;;
+    *) echo "  → No Automation grant yet for /bin/sh -> $BUNDLE: a consent dialog is waiting on" \
+            "$(hostname -s)'s screen. Unlock it and click Allow." ;;
+  esac
+  exit 0   # not an error — the 10-min tick retries once a human fixes it
+fi