diff --git a/README.md b/README.md
index fadc98d..5de0085 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ If your development setup lives on an external drive, this probably sounds famil
 
 ## What it will never do
 
-- Force-quit your apps or services, or force-eject without a separate confirmation.
+- Force-close apps or processes, or force-eject, without a separate confirmation of the exact scope and data-loss risk.
 - Close something just because its name matches. It only acts on a program it can see holding files on this drive.
 - Tell you "nobody is using it" or "safe to unplug" without checking. If a check fails or times out, it tells you.
 - Touch system processes or other users' processes.
@@ -56,6 +56,8 @@ If your development setup lives on an external drive, this probably sounds famil
 
 Verified terminal and background tasks can also be selected explicitly for termination; these choices start unchecked and may interrupt work. Unverified processes remain manual. If an app is waiting for you to save, use **Continue checking and eject** afterwards. System refusals retain the blocking PID and error details.
 
+After preflight, **Select all / Deselect all** covers verified current-user apps, services and other tasks. **Force close selected…** closes only the selected occupants and rescans without ejecting. **Force close and force eject…** is available without first failing ordinary eject: its separate confirmation lists occupants, images and all affected volumes. With nothing selected, the action reads **Force eject…** and explicitly closes no apps or processes. System/other-user/unverified occupants cannot be selected. Force closing is unavailable on multi-volume targets or while related simulators are active. Scope changes require review again; failed or unverified process closure stops disk actions. App closure can also lose unsaved work on other disks.
+
 Writable disk images can be detached normally after confirmation. If normal detach or eject fails, **Force eject…** shows the affected images and volumes and asks you to accept the risk of lost unsaved data or damaged images. Force is never automatic; timeout results are checked before further action. A forced result is clearly labelled.
 
 ## Language
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 763917a..6c15598 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -48,7 +48,7 @@
 
 ## 它不会做的事
 
-- 不会强杀程序或后台服务，也不会未经单独确认就强制弹出。
+- 不会未经单独确认具体范围和数据丢失风险，就强制关闭应用、进程或强制弹出。
 - 不会因为名字对得上就关掉一个程序，只处理它亲眼看到正在占用这块盘的。
 - 没检查清楚，不会说「没人在用」或「可以拔了」。检查失败或超时，会直接告诉你。
 - 不碰系统进程和其他用户的进程。
@@ -56,6 +56,8 @@
 
 身份已核验的终端任务和后台任务也能逐项勾选终止，默认不勾选，并提醒可能中断工作；无法核验的对象仍需手动处理。应用等待保存时，处理后可以「继续检查并弹出」；系统拒绝时会保留阻塞 PID 和错误详情。
 
+预检完成后，可「全选／取消全选」身份和占用已核验的当前用户应用、服务及其他任务。「强制关闭所选项…」仅关闭选中对象，再重新检测，不弹出磁盘；「强制关闭并强制弹出…」无需先让普通弹出失败，单独确认页列明占用者、映像及所有受影响卷。零选中时入口显示「强制弹出…」，明确不会关闭任何应用或进程。系统、其他用户及无法核验的对象不可选。多卷磁盘或仍有相关模拟器运行时，不支持强制关闭；范围变化需要重新确认，关闭失败或结果未确认则停止磁盘操作。关闭整个应用也可能丢失其他磁盘上的未保存工作。
+
 可写磁盘映像也能在确认后普通推出。普通推出或弹出失败后，可点击「强制弹出…」，核对受影响的映像和卷，并确认可能丢失未保存数据、损坏映像的风险。强制不会自动发生；超时先核对结果。完成后会明确标注是否使用过强制操作。
 
 ## 语言
diff --git a/Resources/Info.plist b/Resources/Info.plist
index de6b1f9..1bdf8f0 100644
--- a/Resources/Info.plist
+++ b/Resources/Info.plist
@@ -19,9 +19,9 @@
 	<!-- Semantic version, matched by the git tag (v1.0.0) and compared against
 	     the latest GitHub release by UpdateChecker. -->
 	<key>CFBundleShortVersionString</key>
-	<string>1.4.1</string>
+	<string>1.5.0</string>
 	<key>CFBundleVersion</key>
-	<string>17</string>
+	<string>18</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>14.0</string>
 	<!-- Required to ask Android Studio / Xcode to quit via AppleScript. Without this
diff --git a/Sources/DevDiskKit/Core/EjectFailure.swift b/Sources/DevDiskKit/Core/EjectFailure.swift
index f12b463..e46336e 100644
--- a/Sources/DevDiskKit/Core/EjectFailure.swift
+++ b/Sources/DevDiskKit/Core/EjectFailure.swift
@@ -20,9 +20,10 @@ struct EjectFailure: Equatable {
     var allowsForce = false
     var relatedImages: [DiskImage] = []
     var pendingImage: DiskImage? = nil
+    var forceRequested: Set<ProcessIdentity> = []
 
     private var stageLabel: String {
-        let keys = ["validate": "ejectflow.verify.target.and.scope", "apps": "ejectflow.request.apps.to.quit",
+        let keys = ["force-processes": "forceprocess.close.selected", "validate": "ejectflow.verify.target.and.scope", "apps": "ejectflow.request.apps.to.quit",
                     "simulators": "ejectflow.shutdown.related.simulators",
                     "daemons": "ejectflow.stop.approved.background.services", "images": "ejectflow.eject.read.only.disk.images",
                     "recheck": "ejectflow.recheck.open.files", "unmount": "ejectflow.ask.macos.to.eject",
@@ -36,6 +37,7 @@ struct EjectFailure: Equatable {
          M("ejectfailure.disk", target.physicalDisk).text, M("ejectfailure.stage", stageLabel).text,
          M("ejectfailure.pid", blockingPID.map(String.init) ?? L("ejectfailure.unknown")).text,
          M("ejectflow.apps.quit.service.processes.stopped.images.ejected.requests", completedApps, completedProcesses, completedImages).text]
+        if !forceRequested.isEmpty { lines.append(L("forceprocess.requests", forceRequested.count)) }
         if forceUsed { lines.append(L("ejectforce.used")) }
         if let commandExitCode {
             lines.append(M("ejectfailure.command.result", commandExitCode,
diff --git a/Sources/DevDiskKit/Core/EjectFlow.swift b/Sources/DevDiskKit/Core/EjectFlow.swift
index 6d48867..07cd6f0 100644
--- a/Sources/DevDiskKit/Core/EjectFlow.swift
+++ b/Sources/DevDiskKit/Core/EjectFlow.swift
@@ -1,6 +1,7 @@
 import Foundation
 
-enum EjectMode { case prepared, systemOnly, force }
+enum EjectMode { case prepared, systemOnly, force, forceProcesses }
+enum ForceProcessAction: Equatable { case closeOnly, closeAndEject }
 
 struct EjectPlan: Equatable {
     let target: EjectTarget
@@ -17,6 +18,20 @@ struct EjectPlan: Equatable {
     var completedDaemons: Int = 0
     var completedImages: Int = 0
     var selectedTasks: Set<ProcessIdentity> = []
+    var selectedForceProcesses: Set<ProcessIdentity> = []
+    var forceProcessConfirmation: ForceProcessAction? = nil
+    var forceRequested: Set<ProcessIdentity> = []
+    var forceEligible: Set<ProcessIdentity> {
+        Set(holders.filter { $0.kind != .system && ($0.openFileCount ?? 0) > 0 }
+            .compactMap(\.identity).filter(\.canForceClose))
+    }
+    var reviewedProcessScope: Set<ProcessIdentity> { Set(holders.compactMap(\.identity)) }
+    var canForceProcesses: Bool {
+        !incomplete && simulators.isEmpty && !target.multipleVolumes
+            && !target.affected.isEmpty && target.affected.allSatisfy { !$0.uuid.isEmpty }
+            && selectedForceProcesses.isSubset(of: forceEligible)
+    }
+    var canCloseSelected: Bool { canForceProcesses && !selectedForceProcesses.isEmpty }
     var requested: [ProcessIdentity: HolderKind] = [:]
     var credited: Set<ProcessIdentity> = []
     var notice: Message? = nil
@@ -98,6 +113,9 @@ final class EjectFlow: @unchecked Sendable {
     private var stoppedDaemons = 0
     private var detachedImages = 0
     private var forceUsed = false
+    private var selectedForceProcesses: Set<ProcessIdentity> = []
+    private var forceRequested: Set<ProcessIdentity> = []
+    var onForceProcesses: (Set<ProcessIdentity>) -> Void = { _ in }
     private var relatedImages: [DiskImage] = []
     private var completedDetail: Message {
         M("ejectflow.apps.quit.service.processes.stopped.images.ejected.requests", stoppedApps, stoppedDaemons, detachedImages)
@@ -165,13 +183,18 @@ final class EjectFlow: @unchecked Sendable {
     func run(indexingOn: Bool?) -> Outcome {
         do {
             let plan = try prepare(indexingOn: indexingOn)
-            if plan.requiresConfirmation { return .preview(plan) }
+            if plan.requiresConfirmation || plan.holders.contains(where: { ($0.openFileCount ?? 0) > 0 }) {
+                return .preview(plan)
+            }
             return execute(plan, mode: .prepared)
         } catch { return .aborted(error.displayMessage) }
     }
 
     func execute(_ approved: EjectPlan, mode: EjectMode) -> Outcome {
+        if mode == .forceProcesses { return executeForceProcesses(approved) }
         if mode == .force { return executeForce(approved) }
+        guard approved.forceProcessConfirmation == nil else { return .aborted(M("forceprocess.confirm.required")) }
+        restoreForceProcesses(approved)
         let systemOnly = mode == .systemOnly
         let started = now()
         stoppedApps = approved.completedApps; stoppedDaemons = approved.completedDaemons; detachedImages = approved.completedImages
@@ -330,8 +353,124 @@ final class EjectFlow: @unchecked Sendable {
         }
     }
 
+    private func restoreForceProcesses(_ plan: EjectPlan) {
+        selectedForceProcesses = plan.selectedForceProcesses
+        forceRequested = plan.forceRequested
+        onForceProcesses(forceRequested)
+    }
+
+    private func forceProcessScopeMatches(_ fresh: EjectPlan, approved: EjectPlan) -> Bool {
+        fresh.target == approved.target && !fresh.incomplete && fresh.simulators.isEmpty
+            && !fresh.target.multipleVolumes
+            && fresh.reviewedProcessScope.isSubset(of: approved.reviewedProcessScope)
+            && fresh.images.allSatisfy { approved.images.contains($0) }
+            && now().timeIntervalSince(approved.createdAt) <= 30
+    }
+
+    private func forceProcessPreview(_ fresh: EjectPlan, action: ForceProcessAction?, notice: Message? = nil) -> Outcome {
+        var next = fresh
+        next.forceProcessConfirmation = action
+        return previewOutcome(next, notice: notice)
+    }
+
+    /// Read-only: entering this page is not permission to signal a process or a disk.
+    func prepareForceProcesses(_ previous: EjectPlan, action: ForceProcessAction) -> Outcome {
+        restoreForceProcesses(previous)
+        stoppedApps = previous.completedApps; stoppedDaemons = previous.completedDaemons
+        detachedImages = previous.completedImages; forceUsed = previous.forceUsed
+        selectedTasks = previous.selectedTasks; requested = previous.requested; credited = previous.credited
+        lastFailure = previous.failure
+        do {
+            let fresh = try prepare()
+            guard fresh.target == previous.target else { throw ProbeFailure(M("ejectforce.target.changed")) }
+            return forceProcessPreview(fresh, action: action)
+        } catch { return .aborted(error.displayMessage) }
+    }
+
+    private func executeForceProcesses(_ approved: EjectPlan) -> Outcome {
+        restoreForceProcesses(approved)
+        stoppedApps = approved.completedApps; stoppedDaemons = approved.completedDaemons
+        detachedImages = approved.completedImages; forceUsed = approved.forceUsed
+        selectedTasks = approved.selectedTasks; requested = approved.requested; credited = approved.credited
+        lastFailure = approved.failure; relatedImages = approved.images
+        steps = [Step(id: "validate", title: M("ejectflow.verify.target.and.scope"), state: .running),
+                 Step(id: "force-processes", title: M("forceprocess.close.selected"))]
+        emit()
+        do {
+            guard let action = approved.forceProcessConfirmation, approved.canForceProcesses,
+                  action == .closeAndEject || approved.canCloseSelected else {
+                throw ProbeFailure(M("forceprocess.confirm.required"))
+            }
+            var fresh = try prepare()
+            guard forceProcessScopeMatches(fresh, approved: approved) else {
+                return forceProcessPreview(fresh, action: action)
+            }
+            set("validate", .done(nil)); set("force-processes", .running)
+            for identity in forceRequested where !credited.contains(identity) {
+                if try inspector.identity(identity.pid) != identity { creditExit(identity) }
+            }
+            for identity in approved.selectedForceProcesses.sorted(by: { $0.pid < $1.pid }) {
+                try cancellation.check()
+                fresh = try prepare()
+                guard forceProcessScopeMatches(fresh, approved: approved) else {
+                    return forceProcessPreview(fresh, action: action)
+                }
+                guard fresh.forceEligible.contains(identity) else {
+                    if forceRequested.contains(identity), try inspector.identity(identity.pid) != identity { creditExit(identity) }
+                    continue
+                }
+                guard try inspector.identity(identity.pid) == identity else {
+                    return forceProcessPreview(try prepare(), action: action)
+                }
+                if !forceRequested.contains(identity) {
+                    try cancellation.check()
+                    try inspector.forceClose(identity)
+                    forceRequested.insert(identity)
+                    requested[identity] = identity.bundleID == nil ? .manual : .guiApp
+                    onForceProcesses(forceRequested)
+                }
+                let deadline = monotonicNow() + quitTimeout
+                while true {
+                    try cancellation.check()
+                    fresh = try prepare()
+                    guard forceProcessScopeMatches(fresh, approved: approved) else {
+                        return forceProcessPreview(fresh, action: action)
+                    }
+                    let live = try inspector.identity(identity.pid)
+                    if live != identity { creditExit(identity); break }
+                    if !fresh.reviewedProcessScope.contains(identity) { break }
+                    let remaining = deadline - monotonicNow()
+                    guard remaining > 0.001 else { throw ProbeFailure(M("forceprocess.timeout")) }
+                    sleep(min(0.1, remaining))
+                }
+            }
+            fresh = try prepare()
+            guard forceProcessScopeMatches(fresh, approved: approved) else {
+                return forceProcessPreview(fresh, action: action)
+            }
+            set("force-processes", forceRequested.isEmpty
+                ? .skipped(M("forceprocess.no.close")) : .done(M("forceprocess.requests", forceRequested.count)))
+            if action == .closeOnly { return forceProcessPreview(fresh, action: nil) }
+            // Only this private call can authorize the direct joint disk route. The
+            // original confirmation remains the scope ceiling throughout disk actions.
+            var joint = approved
+            joint.completedApps = stoppedApps; joint.completedDaemons = stoppedDaemons
+            joint.requested = requested; joint.credited = credited; joint.forceRequested = forceRequested
+            return executeForce(joint, jointAuthorization: true)
+        } catch {
+            let reason = error.displayMessage
+            recordFailure(approved.target, stage: "force-processes", message: reason)
+            set("force-processes", .failed(reason))
+            // Preserve sent requests even after failure; refreshing never sends them again.
+            var retained = approved
+            retained.forceProcessConfirmation = nil
+            return previewOutcome(retained, notice: reason)
+        }
+    }
+
     /// A separate read-only step creates a fresh, single-use force confirmation.
     func prepareForce(_ failure: EjectFailure) -> Outcome {
+        forceRequested = failure.forceRequested; onForceProcesses(forceRequested)
         stoppedApps = failure.completedApps; stoppedDaemons = failure.completedProcesses
         detachedImages = failure.completedImages; forceUsed = failure.forceUsed
         relatedImages = failure.relatedImages; lastFailure = failure
@@ -356,7 +495,8 @@ final class EjectFlow: @unchecked Sendable {
         }
     }
 
-    private func executeForce(_ approved: EjectPlan) -> Outcome {
+    private func executeForce(_ approved: EjectPlan, jointAuthorization: Bool = false) -> Outcome {
+        restoreForceProcesses(approved)
         stoppedApps = approved.completedApps; stoppedDaemons = approved.completedDaemons
         detachedImages = approved.completedImages; forceUsed = approved.forceUsed
         relatedImages = approved.images + (approved.failure?.relatedImages ?? [])
@@ -369,14 +509,18 @@ final class EjectFlow: @unchecked Sendable {
         emit()
         let started = now()
         do {
-            guard approved.forceConfirmation, approved.canForce else { throw ProbeFailure(M("ejectforce.not.allowed")) }
+            guard jointAuthorization
+                ? approved.forceProcessConfirmation == .closeAndEject
+                : (approved.forceProcessConfirmation == nil && approved.forceConfirmation && approved.canForce)
+            else { throw ProbeFailure(M("ejectforce.not.allowed")) }
             func freshPlan() throws -> EjectPlan {
                 var plan = try prepareForForce(approved.target)
                 guard plan.target.volume == approved.target.volume,
                       plan.target.physicalDisk == approved.target.physicalDisk else {
                     throw ProbeFailure(M("ejectforce.target.changed"))
                 }
-                plan.forceConfirmation = true
+                plan.forceConfirmation = !jointAuthorization
+                plan.forceProcessConfirmation = jointAuthorization ? .closeAndEject : nil
                 return plan
             }
             func inScope(_ plan: EjectPlan) -> Bool {
@@ -384,6 +528,8 @@ final class EjectFlow: @unchecked Sendable {
                     && plan.simulatorsKnown && plan.simulators.isEmpty
                     && plan.images.allSatisfy { approved.images.contains($0) }
                     && now().timeIntervalSince(approved.createdAt) <= 30
+                    && (!jointAuthorization || (!plan.incomplete
+                        && plan.reviewedProcessScope.isSubset(of: approved.reviewedProcessScope)))
             }
             let fresh = try freshPlan()
             guard inScope(fresh) else { return previewOutcome(fresh) }
@@ -394,7 +540,8 @@ final class EjectFlow: @unchecked Sendable {
                 let current = try freshPlan()
                 guard inScope(current) else { return previewOutcome(current) }
                 guard current.images.contains(image) else { continue }
-                if let outcome = detachImage(image, target: approved.target, force: true) { return outcome }
+                if let outcome = detachImage(image, target: approved.target, force: true,
+                                             processApproval: jointAuthorization ? approved : nil) { return outcome }
             }
             set("images", .done(M("ejectflow.images.ejected", detachedImages)))
             let current = try freshPlan()
@@ -408,6 +555,10 @@ final class EjectFlow: @unchecked Sendable {
                 throw ProbeFailure(M("ejectforce.target.changed"))
             }
             if !before.mountedVolumes.isEmpty {
+                if jointAuthorization {
+                    let boundary = try freshPlan()
+                    guard inScope(boundary), boundary.images.isEmpty else { return previewOutcome(boundary) }
+                }
                 set("force-unmount", .running)
                 guard cancellation.commit() else { throw ProbeFailure(M("ejectflow.operation.cancelled")) }
                 forceUsed = true
@@ -445,12 +596,16 @@ final class EjectFlow: @unchecked Sendable {
 
     /// Disk commands are committed while running. Cancellation can stop the next step,
     /// but cannot claim an in-flight detach has been undone.
-    private func detachImage(_ image: DiskImage, target: EjectTarget, force: Bool) -> Outcome? {
+    private func detachImage(_ image: DiskImage, target: EjectTarget, force: Bool,
+                             processApproval: EjectPlan? = nil) -> Outcome? {
         let stage = force ? "force-images" : "images"
         do {
             let current = try prepare()
             guard current.target == target else { throw ProbeFailure(M("ejectflow.the.target.drive.changed")) }
             guard current.simulatorsKnown, current.simulators.isEmpty else { return previewOutcome(current) }
+            if let processApproval, !forceProcessScopeMatches(current, approved: processApproval) {
+                return forceProcessPreview(current, action: processApproval.forceProcessConfirmation)
+            }
             guard cancellation.commit() else { throw ProbeFailure(M("ejectflow.operation.cancelled")) }
             if force { forceUsed = true }
             onCommit()
@@ -523,6 +678,7 @@ final class EjectFlow: @unchecked Sendable {
 
     /// Read-only refresh keeps completed actions and pending quit requests.
     func recheck(_ previous: EjectPlan) -> Outcome {
+        restoreForceProcesses(previous)
         stoppedApps = previous.completedApps; stoppedDaemons = previous.completedDaemons
         detachedImages = previous.completedImages; selectedTasks = previous.selectedTasks
         requested = previous.requested; credited = previous.credited; lastFailure = previous.failure
@@ -530,6 +686,7 @@ final class EjectFlow: @unchecked Sendable {
         do {
             var fresh = try prepare(unmountedTarget: previous.forceUsed ? previous.target : nil)
             fresh.forceConfirmation = previous.forceConfirmation
+            fresh.forceProcessConfirmation = previous.forceProcessConfirmation
             guard fresh.target == previous.target else { throw ProbeFailure(M("ejectflow.the.target.drive.changed")) }
             return previewOutcome(fresh, notice: previous.notice)
         } catch { return .aborted(error.displayMessage) }
@@ -539,6 +696,7 @@ final class EjectFlow: @unchecked Sendable {
     /// repeats process actions, so a late Disk Arbitration update can safely repair
     /// a previously pending result.
     func reverify(_ previous: EjectFailure) -> Outcome {
+        forceRequested = previous.forceRequested; onForceProcesses(forceRequested)
         stoppedApps = previous.completedApps
         stoppedDaemons = previous.completedProcesses
         detachedImages = previous.completedImages
@@ -576,7 +734,7 @@ final class EjectFlow: @unchecked Sendable {
                                    commandTimedOut: previous.commandTimedOut,
                                    commandCancelled: previous.commandCancelled,
                                    verificationDuration: duration, verification: verification, forceUsed: forceUsed,
-                                   relatedImages: relatedImages)
+                                   relatedImages: relatedImages, forceRequested: forceRequested)
         lastFailure = updated
         onFailure(updated)
         set("verify", .failed(reason))
@@ -589,6 +747,8 @@ final class EjectFlow: @unchecked Sendable {
         updated.completedDaemons = stoppedDaemons
         updated.completedImages = detachedImages
         updated.selectedTasks = selectedTasks.intersection(plan.processScope)
+        updated.selectedForceProcesses = selectedForceProcesses.intersection(plan.forceEligible)
+        updated.forceRequested = forceRequested
         updated.requested = requested
         updated.credited = credited
         updated.notice = notice
@@ -659,7 +819,8 @@ final class EjectFlow: @unchecked Sendable {
                                    commandCancelled: command?.cancelled ?? false,
                                    verificationDuration: verificationDuration,
                                    verification: verification, forceUsed: forceUsed, allowsForce: allowsForce,
-                                   relatedImages: relatedImages, pendingImage: pendingImage)
+                                   relatedImages: relatedImages, pendingImage: pendingImage,
+                                   forceRequested: forceRequested)
         lastFailure = failure
         onFailure(failure)
         return failure
@@ -700,6 +861,23 @@ final class EjectFlow: @unchecked Sendable {
             guard simulatorCheck.simulatorsKnown, simulatorCheck.simulators.isEmpty else {
                 return previewOutcome(simulatorCheck)
             }
+            if approved.forceProcessConfirmation == .closeAndEject {
+                guard simulatorCheck.reviewedProcessScope.isSubset(of: approved.reviewedProcessScope),
+                      simulatorCheck.images.isEmpty else {
+                    return forceProcessPreview(simulatorCheck, action: .closeAndEject)
+                }
+                if simulatorCheck.incomplete {
+                    // allowUnmounted is a mode, not evidence: the same volume may
+                    // have remounted since force-unmount. Only freshly verified
+                    // absence of all related mounts can explain a missing scan.
+                    let observed = targets.ejectVerification(approved.target, runner: scoped, timeout: Deadline.quick)
+                    guard allowUnmounted, observed.issue == nil, observed.relatedMountsKnown,
+                          observed.mountedVolumes.isEmpty,
+                          observed.state == .unmounted || observed.state == .offline else {
+                        return forceProcessPreview(simulatorCheck, action: .closeAndEject)
+                    }
+                }
+            }
             guard cancellation.commit() else { throw ProbeFailure(M("ejectflow.operation.cancelled")) }
             onCommit()
             set("unmount", .running)
diff --git a/Sources/DevDiskKit/Core/ProcessIdentity.swift b/Sources/DevDiskKit/Core/ProcessIdentity.swift
index 2ffb9fc..1169b6d 100644
--- a/Sources/DevDiskKit/Core/ProcessIdentity.swift
+++ b/Sources/DevDiskKit/Core/ProcessIdentity.swift
@@ -18,13 +18,15 @@ struct ProcessIdentity: Hashable {
                 .contains { executable.hasPrefix($0) }
     }
 
-    var canTerminateTask: Bool { uid == getuid() && bundleID == nil && !isProtectedService }
+    var canForceClose: Bool { uid == getuid() && !isProtectedService }
+    var canTerminateTask: Bool { canForceClose && bundleID == nil }
 }
 
 protocol ProcessInspecting {
     /// nil means known to have exited; failure means the identity cannot be established.
     func identity(_ pid: Int32) throws -> ProcessIdentity?
     func requestQuit(_ identity: ProcessIdentity) throws
+    func forceClose(_ identity: ProcessIdentity) throws
 }
 
 struct SystemProcessInspector: ProcessInspecting {
@@ -50,6 +52,27 @@ struct SystemProcessInspector: ProcessInspecting {
                                appName: app?.localizedName)
     }
 
+    func forceClose(_ expected: ProcessIdentity) throws {
+        guard expected.canForceClose else { throw ProbeFailure(M("forceprocess.ineligible")) }
+        if expected.bundleID != nil {
+            let request = { () throws -> Bool in
+                guard try identity(expected.pid) == expected else {
+                    throw ProbeFailure(M("ejectflow.process.identity.changed.scan.again"))
+                }
+                return NSRunningApplication(processIdentifier: expected.pid)?.forceTerminate() == true
+            }
+            let accepted = try Thread.isMainThread ? request() : DispatchQueue.main.sync(execute: request)
+            guard accepted else { throw ProbeFailure(M("forceprocess.refused")) }
+        } else {
+            guard try identity(expected.pid) == expected else {
+                throw ProbeFailure(M("ejectflow.process.identity.changed.scan.again"))
+            }
+            guard Darwin.kill(expected.pid, SIGKILL) == 0 else {
+                throw ProbeFailure(M("forceprocess.refused"))
+            }
+        }
+    }
+
     func requestQuit(_ expected: ProcessIdentity) throws {
         guard try identity(expected.pid) == expected else {
             throw ProbeFailure(M("processidentity.application.identity.changed.scan.again"))
diff --git a/Sources/DevDiskKit/Resources/en.lproj/Localizable.strings b/Sources/DevDiskKit/Resources/en.lproj/Localizable.strings
index 1700d7d..ebbbe45 100644
--- a/Sources/DevDiskKit/Resources/en.lproj/Localizable.strings
+++ b/Sources/DevDiskKit/Resources/en.lproj/Localizable.strings
@@ -374,3 +374,28 @@
 "ejectimage.writable" = "Writable";
 "ejectimage.readonly" = "Read-only";
 "ejectimage.unmounted.attached" = "Not mounted, but still attached";
+"forceprocess.ineligible" = "Not selectable: system/other-user process, or identity and open files could not be verified.";
+"forceprocess.refused" = "Force close was refused. No further actions were taken.";
+"forceprocess.confirm.required" = "Select verified occupants and review a separate force-close confirmation first.";
+"forceprocess.timeout" = "Force close has not released the files. Check the remaining occupants; the disk was not ejected.";
+"forceprocess.requests" = "Force-close requests sent: {0}. Unsaved work may have been lost.";
+"forceprocess.close.selected" = "Force close selected…";
+"forceprocess.close.and.eject" = "Force close and force eject…";
+"forceprocess.confirm.close" = "Confirm force close";
+"forceprocess.confirm.joint" = "Confirm force close and force eject";
+"forceprocess.risk.close" = "Force close the selected apps and processes below? Unsaved work may be lost, including work on other disks. This does not eject the disk. Already sent requests cannot be undone.";
+"forceprocess.risk.joint" = "Force close the selected occupants, force detach the listed images, and force unmount and eject the entire disk and listed volumes? Unselected and protected occupants will not be killed but may lose access to files. Unsaved work, including work on other disks, may be lost; files and images may be damaged. These actions cannot be undone.";
+"forceprocess.occupants" = "Apps and processes using the disk";
+"forceprocess.selection.count" = "Selected {0} / eligible {1}";
+"forceprocess.select.all" = "Select all";
+"forceprocess.deselect.all" = "Deselect all";
+"forceprocess.select" = "Select {0} for force close";
+"forceprocess.selected" = "Will be force closed";
+"forceprocess.unselected" = "Not selected — will not be closed";
+"forceprocess.normal.note" = "Force-close selections start unchecked. Normal eject still requests apps to quit, sends TERM to approved services, and requires separate permission for other tasks.";
+"forceprocess.scope.blocked" = "Force closing is unavailable for multiple mounted volumes or active simulators. Shut down related simulators normally first.";
+"forceprocess.back" = "Back to selection";
+"forceprocess.executing" = "Performing confirmed force actions";
+"forceprocess.confirm.disk.only" = "Confirm force eject";
+"forceprocess.no.close" = "No apps or processes were force closed.";
+"forceprocess.risk.disk.only" = "No apps or processes will be closed. Force detach the listed images, then force unmount and eject the entire disk and listed volumes? The remaining occupants may lose file access; unsaved data may be lost and files or images may be damaged. These actions cannot be undone.";
diff --git a/Sources/DevDiskKit/Resources/zh-Hans.lproj/Localizable.strings b/Sources/DevDiskKit/Resources/zh-Hans.lproj/Localizable.strings
index 0f2174e..445f721 100644
--- a/Sources/DevDiskKit/Resources/zh-Hans.lproj/Localizable.strings
+++ b/Sources/DevDiskKit/Resources/zh-Hans.lproj/Localizable.strings
@@ -374,3 +374,28 @@
 "ejectimage.writable" = "可写";
 "ejectimage.readonly" = "只读";
 "ejectimage.unmounted.attached" = "未挂载，但仍连接着";
+"forceprocess.ineligible" = "不可选择：系统或其他用户进程，或无法核验身份与文件占用。";
+"forceprocess.refused" = "强制关闭被拒绝，已停止后续操作。";
+"forceprocess.confirm.required" = "请先选择已核验的占用者，并单独确认强制关闭风险。";
+"forceprocess.timeout" = "强制关闭后仍未释放占用，请检查剩余占用者；未弹出磁盘。";
+"forceprocess.requests" = "已发送 {0} 个强制关闭请求；未保存的工作可能已经丢失。";
+"forceprocess.close.selected" = "强制关闭所选项…";
+"forceprocess.close.and.eject" = "强制关闭并强制弹出…";
+"forceprocess.confirm.close" = "确认强制关闭";
+"forceprocess.confirm.joint" = "确认强制关闭并强制弹出";
+"forceprocess.risk.close" = "强制关闭下方选中的应用和进程？未保存内容可能丢失，包括其他磁盘上的工作。本操作不弹出磁盘，已发送的请求无法撤销。";
+"forceprocess.risk.joint" = "强制关闭选中的占用者、强制推出下列映像，并强制卸载和弹出整块磁盘及所列相关卷？未选中和受保护的占用者不会被关闭，但可能失去文件访问。未保存内容（包括其他磁盘上的工作）可能丢失，文件和映像可能损坏，操作无法撤销。";
+"forceprocess.occupants" = "占用磁盘的应用与进程";
+"forceprocess.selection.count" = "已选 {0} / 可处理 {1}";
+"forceprocess.select.all" = "全选";
+"forceprocess.deselect.all" = "取消全选";
+"forceprocess.select" = "选择强制关闭 {0}";
+"forceprocess.selected" = "将强制关闭";
+"forceprocess.unselected" = "未选择，不会关闭";
+"forceprocess.normal.note" = "强制关闭默认不勾选。普通弹出仍请求应用正常退出、向已批准服务发送 TERM；其他任务需要单独允许正常终止。";
+"forceprocess.scope.blocked" = "多卷磁盘或仍有运行中的模拟器时，不支持强制关闭。请先正常关闭相关模拟器。";
+"forceprocess.back" = "返回选择";
+"forceprocess.executing" = "正在执行已确认的强制操作";
+"forceprocess.confirm.disk.only" = "确认强制弹出";
+"forceprocess.no.close" = "未强制关闭任何应用或进程。";
+"forceprocess.risk.disk.only" = "不会关闭任何应用或进程。强制推出下列映像，再强制卸载和弹出整块磁盘及所列相关卷？剩余占用者可能失去文件访问，未保存内容可能丢失，文件或映像可能损坏，操作无法撤销。";
diff --git a/Sources/DevDiskKit/Views/Components.swift b/Sources/DevDiskKit/Views/Components.swift
index f92256b..e1f3ccf 100644
--- a/Sources/DevDiskKit/Views/Components.swift
+++ b/Sources/DevDiskKit/Views/Components.swift
@@ -19,6 +19,11 @@ enum UI {
         let available = NSScreen.main?.visibleFrame.height ?? 900
         return max(320, available - 220)
     }
+    /// Reserve the measured non-scrolling controls plus title/arrow, dividers and
+    /// a small edge margin. The force-action footer is taller than the normal one.
+    static func boundedBodyHeight(preferred: CGFloat, available: CGFloat, chrome: CGFloat) -> CGFloat {
+        max(1, min(preferred, available - chrome - 48))
+    }
     static let hPad: CGFloat = 14
     static let vPad: CGFloat = 12
 
diff --git a/Sources/DevDiskKit/Views/DemoFixture.swift b/Sources/DevDiskKit/Views/DemoFixture.swift
index 9616919..750433a 100644
--- a/Sources/DevDiskKit/Views/DemoFixture.swift
+++ b/Sources/DevDiskKit/Views/DemoFixture.swift
@@ -23,6 +23,10 @@ final class DemoMachine: CommandRunner, ProcessInspecting, TargetInspecting, Sim
         if scenario.contains("tasks") {
             live[90100] = .init(pid: 90100, uid: getuid(), startedSeconds: 42, startedMicros: 0, executable: "/bin/zsh")
         }
+        if scenario.contains("force") {
+            live[90101] = .init(pid: 90101, uid: getuid(), startedSeconds: 42, startedMicros: 0, executable: "/usr/bin/java")
+            live[90102] = .init(pid: 90102, uid: getuid(), startedSeconds: 42, startedMicros: 0, executable: "/usr/libexec/demo-service")
+        }
         if scenario.contains("simulators") {
             simulators = [.init(udid: "DEMO-SIM-001", name: "iPhone 演示设备",
                                 runtimeIdentifier: "com.apple.CoreSimulator.SimRuntime.iOS-演示版",
@@ -58,6 +62,11 @@ final class DemoMachine: CommandRunner, ProcessInspecting, TargetInspecting, Sim
                                   runtimeIdentifier: device.runtimeIdentifier, state: "Shutdown",
                                   dataPath: device.dataPath, runtimePath: device.runtimePath)
     }
+    func forceClose(_ identity: ProcessIdentity) throws {
+        guard live[identity.pid] == identity, identity.canForceClose else { throw ProbeFailure("demo identity changed") }
+        if scenario.contains("closerefused") { throw ProbeFailure("demo force close refused") }
+        live.removeValue(forKey: identity.pid)
+    }
     func requestQuit(_ identity: ProcessIdentity) throws {
         if !scenario.contains("running") && !scenario.contains("save") { live.removeValue(forKey: identity.pid) }
     }
@@ -76,7 +85,12 @@ final class DemoMachine: CommandRunner, ProcessInspecting, TargetInspecting, Sim
             .init(stdout: Data(text.utf8), stderr: "", exitCode: code)
         }
         switch path {
-        case Tool.ps: return result("1 root /sbin/launchd\n" + live.keys.map { "\($0) demo /Applications/Demo.app/Contents/MacOS/editor" }.joined(separator: "\n"))
+        case Tool.ps:
+            return result("1 root /sbin/launchd\n" + live.keys.map { pid in
+                let command = pid == 90101 ? "java org.gradle.launcher.daemon.bootstrap.GradleDaemon"
+                    : live[pid]!.executable
+                return "\(pid) demo \(command)"
+            }.joined(separator: "\n"))
         case Tool.lsof:
             if args.last != mount { return result("", code: 1) }
             if scenario.contains("unknown") { return .init(stdout: Data(), stderr: "演示：检测超时，结果不完整", exitCode: -1, timedOut: true) }
diff --git a/Sources/DevDiskKit/Views/DiskStore.swift b/Sources/DevDiskKit/Views/DiskStore.swift
index 69e1185..440dab9 100644
--- a/Sources/DevDiskKit/Views/DiskStore.swift
+++ b/Sources/DevDiskKit/Views/DiskStore.swift
@@ -31,6 +31,7 @@ final class DiskStore: ObservableObject {
     @Published var ejectPlan: EjectPlan?
     @Published var waitingForSystem = false
     @Published var forceWasUsed = false
+    @Published var forceProcessRequestCount = 0
     @Published private var verifiedEjected: Screen?
     @Published var mountPoint = ""
     @Published var drives: [DiscoveredVolume] = []
@@ -147,7 +148,12 @@ final class DiskStore: ObservableObject {
                     screen = .connected
                     ejectFailure = M("diskstore.mount.state.changed.the.preview.is.no.longer")
                     refresh()
-                } else if ejectPlan?.forceConfirmation != true { cancelEject() }
+                } else if ejectPlan?.forceConfirmation != true
+                            && ejectPlan?.forceProcessConfirmation != .closeAndEject {
+                    cancelEject()
+                }
+                // Forced disk routes expect their own unmount notifications.
+                // Their execution boundary still revalidates target and scope.
             }
             return
         }
@@ -369,13 +375,44 @@ final class DiskStore: ObservableObject {
         if selected { ejectPlan?.selectedTasks.insert(identity) }
         else { ejectPlan?.selectedTasks.remove(identity) }
     }
+    func selectForceProcess(_ identity: ProcessIdentity, selected: Bool) {
+        guard operation == .awaitingConfirmation, let plan = ejectPlan,
+              plan.forceProcessConfirmation == nil, !plan.forceConfirmation,
+              plan.forceEligible.contains(identity) else { return }
+        if selected { ejectPlan?.selectedForceProcesses.insert(identity) }
+        else { ejectPlan?.selectedForceProcesses.remove(identity) }
+    }
+    func selectAllForceProcesses(_ selected: Bool) {
+        guard operation == .awaitingConfirmation, let plan = ejectPlan,
+              plan.forceProcessConfirmation == nil, !plan.forceConfirmation else { return }
+        ejectPlan?.selectedForceProcesses = selected ? plan.forceEligible : []
+    }
+    func requestForceProcesses(_ action: ForceProcessAction) {
+        guard operation == .awaitingConfirmation, let plan = ejectPlan,
+              plan.forceProcessConfirmation == nil, !plan.forceConfirmation, plan.canForceProcesses,
+              action == .closeAndEject || plan.canCloseSelected else { return }
+        operationToken?.cancel()
+        let token = CancellationToken()
+        operationToken = token
+        operation = .preflight; screen = .ejecting
+        let flow = makeFlow(runner, mountPoint, token)
+        wire(flow, token: token)
+        ejectQueue.async { [weak self] in
+            let outcome = flow.prepareForceProcesses(plan, action: action)
+            Task { @MainActor in self?.receive(outcome, token: token) }
+        }
+    }
+    func cancelForceProcessConfirmation() {
+        guard operation == .awaitingConfirmation else { return }
+        ejectPlan?.forceProcessConfirmation = nil
+    }
     private func beginPreflight(previous: EjectPlan? = nil) {
         if previous == nil, let failure = ejectDiagnostic, failure.forceUsed,
            failure.target.volume.mount == mountPoint {
             let recovery = EjectPlan(target: failure.target, createdAt: now(), holders: [],
                 images: failure.relatedImages, issues: [], forceUsed: true,
                 completedApps: failure.completedApps, completedDaemons: failure.completedProcesses,
-                completedImages: failure.completedImages, failure: failure)
+                completedImages: failure.completedImages, forceRequested: failure.forceRequested, failure: failure)
             beginPreflight(previous: recovery)
             return
         }
@@ -384,7 +421,7 @@ final class DiskStore: ObservableObject {
         ejectPlan = nil; ejectFailure = nil; lastError = nil; waitingForSystem = false
         ejectVerificationPending = false
         lastEjectVerification = nil
-        if previous == nil { ejectDiagnostic = nil; forceWasUsed = false }
+        if previous == nil { ejectDiagnostic = nil; forceWasUsed = false; forceProcessRequestCount = 0 }
         ejectSteps = [.init(id: "scan", title: M("diskstore.read.only.preflight.verify.target.and.open.files"), state: .running)]
         let token = CancellationToken()
         operationToken = token
@@ -405,6 +442,12 @@ final class DiskStore: ObservableObject {
         }
     }
     nonisolated private func wire(_ flow: EjectFlow, token: CancellationToken) {
+        flow.onForceProcesses = { [weak self] identities in
+            Task { @MainActor in
+                guard let self, self.operationToken === token else { return }
+                self.forceProcessRequestCount = identities.count
+            }
+        }
         flow.onUpdate = { [weak self] steps in
             Task { @MainActor in
                 guard let self, self.operationToken === token, self.operation.locksTarget else { return }
@@ -441,6 +484,9 @@ final class DiskStore: ObservableObject {
     func confirmEject(mode: EjectMode = .prepared) {
         guard operation == .awaitingConfirmation, let plan = ejectPlan,
               let token = operationToken, !token.isCancelled else { return }
+        guard mode != .forceProcesses || (plan.forceProcessConfirmation != nil && plan.canForceProcesses
+            && (plan.forceProcessConfirmation == .closeAndEject || plan.canCloseSelected)) else { return }
+        guard plan.forceProcessConfirmation == nil || mode == .forceProcesses else { return }
         guard mode != .force || (plan.forceConfirmation && plan.canForce) else { return }
         guard !plan.forceConfirmation || mode == .force else { return }
         operation = .executing; screen = .ejecting
@@ -506,6 +552,7 @@ final class DiskStore: ObservableObject {
         case .preview(let plan):
             ejectVerificationPending = false
             forceWasUsed = plan.forceUsed
+            forceProcessRequestCount = plan.forceRequested.count
             ejectPlan = plan; operation = .awaitingConfirmation; screen = .preview
             if let failure = plan.failure { ejectDiagnostic = failure }
             waitingForSystem = false
diff --git a/Sources/DevDiskKit/Views/EjectPreviewView.swift b/Sources/DevDiskKit/Views/EjectPreviewView.swift
index 5dd6984..bc883bd 100644
--- a/Sources/DevDiskKit/Views/EjectPreviewView.swift
+++ b/Sources/DevDiskKit/Views/EjectPreviewView.swift
@@ -18,6 +18,14 @@ struct EjectPreviewView: View {
                     Text(L("ejectforce.risk")).font(.callout).foregroundStyle(.orange).padding(UI.hPad)
                     Text(L("ejectforce.no.process.kill")).font(.caption).foregroundStyle(.secondary).padding(.horizontal, UI.hPad)
                 }
+                if let action = plan.forceProcessConfirmation {
+                    Text(L(action == .closeOnly ? "forceprocess.risk.close" : plan.selectedForceProcesses.isEmpty ? "forceprocess.risk.disk.only" : "forceprocess.risk.joint"))
+                        .font(.callout).foregroundStyle(.orange).padding(UI.hPad)
+                }
+                if !plan.forceRequested.isEmpty {
+                    Text(L("forceprocess.requests", plan.forceRequested.count))
+                        .font(.caption).foregroundStyle(.orange).padding(UI.hPad)
+                }
                 if plan.completedApps + plan.completedDaemons + plan.completedImages > 0 {
                     Text(L("ejectpreviewview.so.far.apps.quit.services.stopped.images.ejected", plan.completedApps, plan.completedDaemons, plan.completedImages))
                         .font(.caption).foregroundStyle(.secondary).padding(UI.hPad)
@@ -28,12 +36,14 @@ struct EjectPreviewView: View {
                 if let failure = plan.failure {
                     EjectFailureDetails(failure: failure).padding(.horizontal, UI.hPad)
                 }
-                if plan.target.multipleVolumes || plan.forceConfirmation {
+                if plan.target.multipleVolumes || plan.forceConfirmation || plan.forceProcessConfirmation == .closeAndEject {
                     PanelSection(title: L("ejectpreviewview.ejecting.the.disk.affects.these.volumes")) {
+                        Text(M("ejectfailure.disk", plan.target.physicalDisk))
+                            .font(.caption).textSelection(.enabled)
                         ForEach(plan.target.affected, id: \.device) { volume in
                             Text("\(volume.name) · \(volume.mount)").font(.caption)
                         }
-                        if !plan.forceConfirmation {
+                        if !plan.forceConfirmation && plan.forceProcessConfirmation == nil {
                             Text(L("ejectpreviewview.this.version.does.not.automatically.handle.processes.on"))
                                 .font(.caption).foregroundStyle(.orange)
                         }
@@ -60,24 +70,46 @@ struct EjectPreviewView: View {
                     }
                 }
                 if !plan.forceConfirmation {
-                    group(L("ejectpreviewview.apps.to.request.to.quit"), plan.apps, note: L("ejectpreviewview.quitting.affects.the.entire.app.each.app.handles"))
-                    group(L("ejectpreviewview.approved.background.services.to.stop"), plan.daemons, note: L("ejectpreviewview.services.may.still.be.working.after.confirmation.sends"))
-                    if !plan.manual.isEmpty {
-                        PanelSection(title: L("ejectpreviewview.other.tasks")) {
-                            Text(L("ejectpreviewview.terminate.warning")).font(.caption).foregroundStyle(.orange)
-                            ForEach(plan.manual) { holder in
-                                HolderRow(holder: holder)
-                                if holder.canTerminateTask, let identity = holder.identity {
-                                    Toggle(L("ejectpreviewview.allow.terminate", holder.displayName), isOn: Binding(
-                                        get: { store.ejectPlan?.selectedTasks.contains(identity) == true },
-                                        set: { store.selectTask(identity, selected: $0) }
-                                    )).toggleStyle(.checkbox).font(.caption)
+                    PanelSection(title: L("forceprocess.occupants")) {
+                        Text(L("forceprocess.selection.count", plan.selectedForceProcesses.count, plan.forceEligible.count))
+                            .font(.caption)
+                        if plan.forceProcessConfirmation == nil {
+                            HStack {
+                                Button(L("forceprocess.select.all")) { store.selectAllForceProcesses(true) }
+                                    .disabled(plan.forceEligible.isEmpty)
+                                Button(L("forceprocess.deselect.all")) { store.selectAllForceProcesses(false) }
+                                    .disabled(plan.selectedForceProcesses.isEmpty)
+                            }.buttonStyle(.bordered)
+                            Text(L("forceprocess.normal.note")).font(.caption).foregroundStyle(.secondary)
+                        }
+                        ForEach(plan.holders) { holder in
+                            HolderRow(holder: holder)
+                            if let identity = holder.identity, plan.forceEligible.contains(identity) {
+                                Text("PID \(identity.pid) · \(identity.executable)")
+                                    .font(.caption2).foregroundStyle(.secondary).textSelection(.enabled)
+                                if plan.forceProcessConfirmation != nil {
+                                    Text(L(plan.selectedForceProcesses.contains(identity)
+                                           ? "forceprocess.selected" : "forceprocess.unselected"))
+                                        .font(.caption).foregroundStyle(.orange)
                                 } else {
-                                    Text(L("ejectpreviewview.save.and.stop.these.tasks.then.scan.again"))
-                                        .font(.caption).foregroundStyle(.secondary)
+                                    Toggle(L("forceprocess.select", holder.displayName), isOn: Binding(
+                                        get: { store.ejectPlan?.selectedForceProcesses.contains(identity) == true },
+                                        set: { store.selectForceProcess(identity, selected: $0) }
+                                    )).toggleStyle(.checkbox).font(.caption)
+                                    if holder.canTerminateTask {
+                                        Toggle(L("ejectpreviewview.allow.terminate", holder.displayName), isOn: Binding(
+                                            get: { store.ejectPlan?.selectedTasks.contains(identity) == true },
+                                            set: { store.selectTask(identity, selected: $0) }
+                                        )).toggleStyle(.checkbox).font(.caption)
+                                    }
                                 }
+                            } else {
+                                Text(L("forceprocess.ineligible")).font(.caption).foregroundStyle(.secondary)
                             }
                         }
+                        if plan.target.multipleVolumes || !plan.simulators.isEmpty {
+                            Text(L("forceprocess.scope.blocked")).font(.caption).foregroundStyle(.orange)
+                        }
                     }
                 }
                 if !plan.images.isEmpty {
@@ -114,7 +146,12 @@ struct EjectPreviewFooter: View {
     var body: some View {
         VStack(spacing: 8) {
             if let plan = store.ejectPlan {
-                if plan.forceConfirmation {
+                if let action = plan.forceProcessConfirmation {
+                    PrimaryButton(title: L(action == .closeOnly ? "forceprocess.confirm.close" : plan.selectedForceProcesses.isEmpty ? "forceprocess.confirm.disk.only" : "forceprocess.confirm.joint"),
+                                  symbol: "exclamationmark.triangle") { store.confirmEject(mode: .forceProcesses) }
+                        .disabled(!plan.canForceProcesses || (action == .closeOnly && !plan.canCloseSelected))
+                    Button(L("forceprocess.back")) { store.cancelForceProcessConfirmation() }.buttonStyle(.bordered)
+                } else if plan.forceConfirmation {
                     PrimaryButton(title: L("ejectforce.confirm"), symbol: "exclamationmark.triangle") { store.confirmEject(mode: .force) }
                         .disabled(!plan.canForce)
                 } else {
@@ -128,7 +165,11 @@ struct EjectPreviewFooter: View {
                         Text(L("ejectpreviewview.does.not.quit.apps.stop.services.eject.images"))
                             .font(.caption).foregroundStyle(.secondary).multilineTextAlignment(.center)
                     }
-                    if store.canOfferForce {
+                    Button(L("forceprocess.close.selected")) { store.requestForceProcesses(.closeOnly) }
+                        .buttonStyle(.bordered).disabled(!plan.canCloseSelected)
+                    Button(L(plan.selectedForceProcesses.isEmpty ? "ejectforce.action" : "forceprocess.close.and.eject")) { store.requestForceProcesses(.closeAndEject) }
+                        .buttonStyle(.bordered).disabled(!plan.canForceProcesses)
+                    if store.canOfferForce && !plan.canForceProcesses {
                         Button(L("ejectforce.action")) { store.requestForceEject() }.buttonStyle(.bordered)
                     }
                 }
diff --git a/Sources/DevDiskKit/Views/EjectingView.swift b/Sources/DevDiskKit/Views/EjectingView.swift
index 53a819f..8e1211d 100644
--- a/Sources/DevDiskKit/Views/EjectingView.swift
+++ b/Sources/DevDiskKit/Views/EjectingView.swift
@@ -14,7 +14,7 @@ struct EjectingView: View {
 
     var body: some View {
         VStack(alignment: .leading, spacing: 0) {
-            PanelSection(title: store.operation == .preflight ? L("ejectingview.running.read.only.preflight") : store.operation == .cancelling ? L("ejectingview.cancelling") : L(store.ejectPlan?.forceConfirmation == true ? "ejectforce.executing" : "ejectingview.ejecting.safely"),
+            PanelSection(title: store.operation == .preflight ? L("ejectingview.running.read.only.preflight") : store.operation == .cancelling ? L("ejectingview.cancelling") : L(store.ejectPlan?.forceProcessConfirmation != nil ? "forceprocess.executing" : store.ejectPlan?.forceConfirmation == true ? "ejectforce.executing" : "ejectingview.ejecting.safely"),
                     aside: "\(doneCount) / \(store.ejectSteps.count)") {
                 VStack(alignment: .leading, spacing: 0) {
                     ForEach(store.ejectSteps) { StepRow(step: $0) }
diff --git a/Sources/DevDiskKit/Views/PanelView.swift b/Sources/DevDiskKit/Views/PanelView.swift
index a45b7cd..f1b031e 100644
--- a/Sources/DevDiskKit/Views/PanelView.swift
+++ b/Sources/DevDiskKit/Views/PanelView.swift
@@ -9,6 +9,13 @@ private struct ContentHeightKey: PreferenceKey {
     }
 }
 
+private struct PanelChromeHeightKey: PreferenceKey {
+    static var defaultValue: CGFloat = 0
+    static func reduce(value: inout CGFloat, nextValue: () -> CGFloat) {
+        value += nextValue()
+    }
+}
+
 struct PanelView: View {
     @ObservedObject private var language = LanguageStore.shared
     @EnvironmentObject var store: DiskStore
@@ -29,10 +36,20 @@ struct PanelView: View {
     /// Natural height of the scrolling content, measured so the popover can be sized
     /// to fit it.
     @State private var contentHeight: CGFloat = 0
+    @State private var chromeHeight: CGFloat = 220
+
+    private var bodyHeightCap: CGFloat {
+        UI.boundedBodyHeight(
+            preferred: presentation == .window ? UI.maxWindowBodyHeight : UI.maxScrollHeight,
+            available: NSScreen.main?.visibleFrame.height ?? 800,
+            chrome: chromeHeight)
+    }
 
     var body: some View {
         VStack(alignment: .leading, spacing: 0) {
-            header
+            header.background(GeometryReader { geometry in
+                Color.clear.preference(key: PanelChromeHeightKey.self, value: geometry.size.height)
+            })
             Divider1()
 
             // A menu bar popover is a card, not a page. Without a bound the connected
@@ -44,19 +61,24 @@ struct PanelView: View {
             // the tallest screen it had shown: the ejected card needed 308pt but the
             // window stayed 633pt, and SwiftUI centred the card in it — a transparent
             // band above and below, and the card sitting far below the menu bar.
-            body(cap: presentation == .window ? UI.maxWindowBodyHeight
-                                              : UI.maxScrollHeight)
+            body(cap: bodyHeightCap)
 
             Divider1()
-            actionFooter
+            actionFooter.background(GeometryReader { geometry in
+                Color.clear.preference(key: PanelChromeHeightKey.self, value: geometry.size.height)
+            })
             if showVersion || updates.available != nil {
                 Divider1()
                 VersionFooter(version: updates.currentVersion,
                               update: updates.available) { url in
                     NSWorkspace.shared.open(url)
                 }
+                .background(GeometryReader { geometry in
+                    Color.clear.preference(key: PanelChromeHeightKey.self, value: geometry.size.height)
+                })
             }
         }
+        .onPreferenceChange(PanelChromeHeightKey.self) { chromeHeight = $0 }
         .frame(width: UI.width)
         // The content height is stateful because long screens switch to a bounded
         // ScrollView. Reset it before measuring a new screen; otherwise a short
@@ -357,6 +379,9 @@ struct EjectedView: View {
                         Text(store.lastEjectVerification
                              ?? M("panelview.physical.disk.offline.related.volumes.unmounted"))
                         if store.forceWasUsed { Text(L("ejectforce.data.warning")).foregroundStyle(.orange) }
+                        if store.forceProcessRequestCount > 0 {
+                            Text(L("forceprocess.requests", store.forceProcessRequestCount)).foregroundStyle(.orange)
+                        }
                         if let s = store.lastEjectSummary { Text(s) }
                     }
                 )
diff --git a/Tests/DevDiskKitTests/FlowHarness.swift b/Tests/DevDiskKitTests/FlowHarness.swift
index d228f6e..62c7d1b 100644
--- a/Tests/DevDiskKitTests/FlowHarness.swift
+++ b/Tests/DevDiskKitTests/FlowHarness.swift
@@ -100,12 +100,22 @@ final class FakeProcessInspector: ProcessInspecting {
     var live: [Int32: ProcessIdentity] = [:]
     var quits: [Int32] = []
     var refuseQuit = false
+    var forced: [Int32] = []
+    var forceWorks = true
+    var rejectForce = false
+    var onForce: (() -> Void)? = nil
     var failIdentity = false
     var onQuit: (() -> Void)?
     func identity(_ pid: Int32) throws -> ProcessIdentity? {
         if failIdentity { throw ProbeFailure("identity denied") }
         return live[pid]
     }
+    func forceClose(_ identity: ProcessIdentity) throws {
+        guard live[identity.pid] == identity, identity.canForceClose, !rejectForce else { throw ProbeFailure("force refused") }
+        forced.append(identity.pid)
+        if forceWorks { live.removeValue(forKey: identity.pid) }
+        onForce?()
+    }
     func requestQuit(_ identity: ProcessIdentity) throws {
         guard live[identity.pid] == identity else { throw ProbeFailure("identity changed") }
         quits.append(identity.pid)
diff --git a/Tests/DevDiskKitTests/ForceProcessTests.swift b/Tests/DevDiskKitTests/ForceProcessTests.swift
new file mode 100644
index 0000000..8f8cf8f
--- /dev/null
+++ b/Tests/DevDiskKitTests/ForceProcessTests.swift
@@ -0,0 +1,351 @@
+import XCTest
+@testable import DevDiskKit
+
+final class ForceProcessTests: XCTestCase {
+    private func confirmed(_ h: FlowHarness, action: ForceProcessAction = .closeAndEject,
+                           select: Set<Int32>? = nil) throws -> EjectPlan {
+        var plan = try h.flow.prepare()
+        plan.selectedForceProcesses = Set(plan.forceEligible.filter { select?.contains($0.pid) ?? true })
+        guard case .preview(let confirmation) = h.flow.prepareForceProcesses(plan, action: action) else {
+            throw ProbeFailure("missing confirmation")
+        }
+        return confirmation
+    }
+    private func assertNoDiskActions(_ h: FlowHarness, file: StaticString = #filePath, line: UInt = #line) {
+        XCTAssertFalse(h.calls.contains { $0.hasPrefix("diskutil eject") || $0.hasPrefix("diskutil unmountDisk") || $0.hasPrefix("hdiutil detach") }, file: file, line: line)
+    }
+
+    func testAllCategoriesEligibleButProtectedForeignAndSelfExcluded() throws {
+        let h = FlowHarness()
+        h.add(pid: 101, app: "editor")
+        h.add(pid: 102)
+        h.add(pid: 103, executable: "/bin/zsh", args: "zsh")
+        h.add(pid: 104, executable: "/usr/libexec/mdworker", args: "mdworker")
+        h.add(pid: 105, uid: getuid() + 1)
+        h.add(pid: getpid(), executable: "/opt/devdisk", args: "devdisk")
+        let p = try h.flow.prepare()
+        XCTAssertTrue(p.selectedForceProcesses.isEmpty)
+        XCTAssertEqual(Set(p.forceEligible.map(\.pid)), [101, 102, 103])
+        XCTAssertEqual(p.apps.count, 1); XCTAssertEqual(p.daemons.count, 1); XCTAssertEqual(p.manual.count, 1)
+        XCTAssertFalse(p.canCloseSelected)
+        XCTAssertTrue(p.canForceProcesses)
+    }
+
+    func testNoActionsBeforeSeparateConfirmationAndLegacyForceStillRequiresFailure() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        var p = try h.flow.prepare(); p.selectedForceProcesses = p.forceEligible
+        _ = h.flow.execute(p, mode: .forceProcesses)
+        _ = h.flow.execute(p, mode: .force)
+        let confirmation = try confirmed(h)
+        XCTAssertNil(confirmation.failure)
+        XCTAssertFalse(confirmation.forceConfirmation)
+        XCTAssertFalse(confirmation.canForce)
+        XCTAssertTrue(confirmation.canForceProcesses)
+        XCTAssertEqual(confirmation.forceProcessConfirmation, .closeAndEject)
+        XCTAssertTrue(h.processes.forced.isEmpty)
+        assertNoDiskActions(h)
+    }
+
+    func testCloseOnlyNeverEjectsAndKeepsSeparateForceHistory() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.add(pid: 456)
+        let p = try confirmed(h, action: .closeOnly)
+        guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("preview") }
+        XCTAssertEqual(h.processes.forced, [123, 456])
+        XCTAssertEqual(next.completedApps, 1); XCTAssertEqual(next.completedDaemons, 1)
+        XCTAssertEqual(next.forceRequested.count, 2)
+        XCTAssertFalse(next.forceUsed); XCTAssertNil(next.forceProcessConfirmation)
+        XCTAssertTrue(next.selectedForceProcesses.isEmpty)
+        XCTAssertTrue(h.processes.quits.isEmpty)
+        assertNoDiskActions(h)
+        guard case .preview(let refreshed) = h.flow.recheck(next) else { return XCTFail("refresh") }
+        XCTAssertEqual(refreshed.forceRequested, next.forceRequested)
+        assertNoDiskActions(h)
+    }
+
+    func testDirectJointActionClosesBeforeImagesUnmountAndEject() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.add(pid: 456)
+        h.images = [.init(path: FlowHarness.mount + "/a.dmg", writable: true, devEntries: ["/dev/disk91"], mountPoints: [])]
+        let p = try confirmed(h)
+        var history: Set<ProcessIdentity> = []
+        let f = h.flow; f.onForceProcesses = { history = $0 }
+        h.onCall = { key in
+            if key.hasPrefix("hdiutil detach") || key.hasPrefix("diskutil unmountDisk") {
+                XCTAssertEqual(h.processes.forced, [123, 456])
+            }
+        }
+        guard case .ejected(_, let apps, let processes, let forced) = f.execute(p, mode: .forceProcesses) else { return XCTFail("joint success") }
+        XCTAssertTrue(forced); XCTAssertEqual(apps, 1); XCTAssertEqual(processes, 1)
+        XCTAssertEqual(history.count, 2)
+        let detach = try XCTUnwrap(h.calls.firstIndex(of: "hdiutil detach /dev/disk91 -force"))
+        let unmount = try XCTUnwrap(h.calls.firstIndex(of: "diskutil unmountDisk force disk90"))
+        let eject = try XCTUnwrap(h.calls.firstIndex(of: "diskutil eject disk90"))
+        XCTAssertLessThan(detach, unmount); XCTAssertLessThan(unmount, eject)
+        XCTAssertFalse(h.calls.contains { $0.hasPrefix("kill") })
+    }
+
+    func testUnselectedAndSystemOccupantsAreNotKilledByJointAction() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.add(pid: 456)
+        h.add(pid: 789, executable: "/usr/libexec/service", args: "service")
+        let p = try confirmed(h, select: [123])
+        guard case .ejected = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("known remaining scope may be unmounted") }
+        XCTAssertEqual(h.processes.forced, [123])
+        XCTAssertNotNil(h.processes.live[456]); XCTAssertNotNil(h.processes.live[789])
+    }
+
+    func testOrdinaryFlowNeverUsesForceSelectionAsPermissionToKill() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.processes.refuseQuit = true
+        var p = try h.flow.prepare(); p.selectedForceProcesses = p.forceEligible
+        guard case .preview = h.flow.execute(p, mode: .prepared) else { return XCTFail("waiting") }
+        XCTAssertEqual(h.processes.quits, [123]); XCTAssertTrue(h.processes.forced.isEmpty)
+        assertNoDiskActions(h)
+    }
+
+    func testExpiredConfirmationRequiresReviewWithoutSideEffects() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        let p = try confirmed(h); h.clock += 31
+        guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("review") }
+        XCTAssertEqual(next.createdAt, h.clock)
+        XCTAssertEqual(next.forceProcessConfirmation, .closeAndEject)
+        XCTAssertTrue(h.processes.forced.isEmpty); assertNoDiskActions(h)
+    }
+
+    func testPIDReuseAndNewOccupantsNeverInheritSelection() throws {
+        for reused in [false, true] {
+            let h = FlowHarness(); h.add(app: "editor")
+            let p = try confirmed(h)
+            if reused {
+                h.processes.live[123] = .init(pid: 123, uid: getuid(), startedSeconds: 99, startedMicros: 0,
+                                             executable: "/bin/zsh")
+            } else { h.add(pid: 456) }
+            guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("review") }
+            XCTAssertFalse(next.selectedForceProcesses.contains { $0.pid == (reused ? 123 : 456) })
+            XCTAssertTrue(h.processes.forced.isEmpty); assertNoDiskActions(h)
+        }
+    }
+
+    func testNewImageAndChangedTargetRequireReview() throws {
+        for changeTarget in [false, true] {
+            let h = FlowHarness(); h.add(app: "editor")
+            let p = try confirmed(h)
+            if changeTarget {
+                let t = h.targetInspector.current
+                h.targetInspector.current = .init(volume: .init(name: "replacement", mount: t.volume.mount,
+                    device: t.volume.device, uuid: "replacement"), physicalDisk: t.physicalDisk, affected: t.affected)
+            } else {
+                h.images = [.init(path: FlowHarness.mount + "/new.dmg", writable: true, devEntries: ["/dev/disk91"], mountPoints: [])]
+            }
+            guard case .preview = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("review") }
+            XCTAssertTrue(h.processes.forced.isEmpty); assertNoDiskActions(h)
+        }
+    }
+
+    func testReleasedHolderIsSkippedEvenIfAppIsStillRunning() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        let p = try confirmed(h, action: .closeOnly)
+        h.files[123] = []
+        guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("refreshed") }
+        XCTAssertTrue(h.processes.forced.isEmpty); XCTAssertEqual(next.completedApps, 0)
+        XCTAssertNotNil(h.processes.live[123]); assertNoDiskActions(h)
+    }
+
+    func testRefusalTimeoutAndIdentityFailureStopDiskActions() throws {
+        for failure in ["refused", "timeout", "identity"] {
+            let h = FlowHarness(); h.add(app: "editor")
+            let p = try confirmed(h)
+            if failure == "refused" { h.processes.rejectForce = true }
+            if failure == "timeout" { h.processes.forceWorks = false }
+            if failure == "identity" { h.processes.failIdentity = true }
+            guard case .preview = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("failure preserved") }
+            assertNoDiskActions(h)
+        }
+    }
+
+    func testTimeoutRetryDoesNotRepeatAcceptedForceRequestAndCreditsLateExit() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.processes.forceWorks = false
+        let p = try confirmed(h)
+        guard case .preview(let failed) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("timeout") }
+        guard case .preview(let retry) = h.flow.prepareForceProcesses(failed, action: .closeOnly) else { return XCTFail("confirm") }
+        guard case .preview(let pending) = h.flow.execute(retry, mode: .forceProcesses) else { return XCTFail("still waiting") }
+        XCTAssertEqual(h.processes.forced, [123])
+        h.processes.live.removeValue(forKey: 123)
+        var resume = pending; resume.forceProcessConfirmation = .closeOnly
+        guard case .preview(let finished) = h.flow.execute(resume, mode: .forceProcesses) else { return XCTFail("released") }
+        XCTAssertEqual(finished.completedApps, 1)
+        XCTAssertEqual(h.processes.forced, [123]); assertNoDiskActions(h)
+    }
+
+    func testNewOccupantAfterFirstCloseStopsBeforeNextCloseOrDisk() throws {
+        let h = FlowHarness(); h.add(app: "editor"); h.add(pid: 456)
+        let p = try confirmed(h)
+        h.processes.onForce = { h.add(pid: 789) }
+        guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("expanded scope") }
+        XCTAssertEqual(h.processes.forced, [123])
+        XCTAssertFalse(next.selectedForceProcesses.contains { $0.pid == 789 })
+        XCTAssertEqual(next.forceRequested.count, 1)
+        assertNoDiskActions(h)
+    }
+
+    func testScanFailureAfterClosureStopsBeforeDisk() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        let p = try confirmed(h)
+        h.processes.onForce = {
+            h.failures["lsof -nP +w -F pcLfn +f -- " + FlowHarness.mount] = .init(stdout: Data(), stderr: "denied", exitCode: 1)
+        }
+        guard case .preview(let next) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("unverified") }
+        XCTAssertTrue(next.incomplete); assertNoDiskActions(h)
+    }
+
+    func testCancellationBeforeAndBetweenActionsStopsRemainingWork() throws {
+        for before in [true, false] {
+            let h = FlowHarness(); h.add(app: "editor"); h.add(pid: 456)
+            let p = try confirmed(h)
+            if before { h.cancellation.cancel() }
+            else { h.processes.onForce = { h.cancellation.cancel() } }
+            _ = h.flow.execute(p, mode: .forceProcesses)
+            XCTAssertEqual(h.processes.forced, before ? [] : [123])
+            assertNoDiskActions(h)
+        }
+    }
+
+    func testMultipleVolumesAndActiveSimulatorsBlockForceProcessActions() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        var p = try confirmed(h)
+        let t = p.target
+        p = EjectPlan(target: .init(volume: t.volume, physicalDisk: t.physicalDisk,
+            affected: t.affected + [.init(name: "Other", mount: "/Volumes/Other", device: "disk90s2", uuid: "other")]),
+                      createdAt: p.createdAt, holders: p.holders, images: [], issues: [])
+        p.selectedForceProcesses = p.forceEligible; p.forceProcessConfirmation = .closeAndEject
+        XCTAssertFalse(p.canForceProcesses)
+        _ = h.flow.execute(p, mode: .forceProcesses)
+        p = try confirmed(h)
+        p.simulators = [.init(udid: "sim", name: "sim", runtimeIdentifier: "runtime", state: "Booted",
+                             dataPath: FlowHarness.mount + "/data", runtimePath: nil)]
+        XCTAssertFalse(p.canForceProcesses)
+        _ = h.flow.execute(p, mode: .forceProcesses)
+        XCTAssertTrue(h.processes.forced.isEmpty); assertNoDiskActions(h)
+    }
+
+    func testNewOccupantAtImageBoundaryStopsDiskUnmount() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        h.images = [.init(path: FlowHarness.mount + "/a.dmg", writable: true, devEntries: ["/dev/disk91"], mountPoints: [])]
+        let p = try confirmed(h)
+        h.onCall = { key in if key == "hdiutil detach /dev/disk91 -force" { h.add(pid: 789) } }
+        guard case .preview = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("review") }
+        XCTAssertFalse(h.calls.contains("diskutil unmountDisk force disk90"))
+        XCTAssertFalse(h.calls.contains("diskutil eject disk90"))
+    }
+
+    func testForceHistorySurvivesUnknownDiskResultAndReadOnlyReverification() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        let p = try confirmed(h)
+        h.failures["diskutil eject disk90"] = .init(stdout: Data(), stderr: "timeout", exitCode: -1, timedOut: true)
+        guard case .verificationPending(let failure, _) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("unknown") }
+        XCTAssertEqual(failure.forceRequested.count, 1)
+        XCTAssertTrue(failure.forceUsed)
+        h.targetInspector.gone = true; h.cancellation = CancellationToken()
+        var history: Set<ProcessIdentity> = []
+        let f = h.flow; f.onForceProcesses = { history = $0 }
+        guard case .ejected = f.reverify(failure) else { return XCTFail("verified") }
+        XCTAssertEqual(history, failure.forceRequested)
+        XCTAssertEqual(h.processes.forced, [123])
+        XCTAssertEqual(h.calls.filter { $0 == "diskutil eject disk90" }.count, 1)
+    }
+
+    func testSystemInspectorRejectsProtectedIdentityBeforeAnySignal() {
+        let identity = ProcessIdentity(pid: getpid(), uid: getuid(), startedSeconds: 0, startedMicros: 0,
+                                       executable: "/opt/devdisk")
+        XCTAssertThrowsError(try SystemProcessInspector().forceClose(identity))
+    }
+
+    func testZeroSelectionSystemOnlyOccupancyCanDirectlyConfirmDiskForce() throws {
+        let h = FlowHarness(); h.add(executable: "/usr/libexec/service", args: "service")
+        let p = try confirmed(h)
+        XCTAssertTrue(p.selectedForceProcesses.isEmpty)
+        XCTAssertTrue(p.canForceProcesses); XCTAssertFalse(p.canCloseSelected)
+        XCTAssertNil(p.failure)
+        guard case .ejected(_, let apps, let daemons, let forced) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("direct disk force") }
+        XCTAssertTrue(forced); XCTAssertEqual(apps + daemons, 0)
+        XCTAssertTrue(h.processes.forced.isEmpty)
+    }
+
+    func testZeroSelectionCannotBypassCancellationOrIncompleteScan() throws {
+        for cancel in [true, false] {
+            let h = FlowHarness(); h.add(executable: "/usr/libexec/service", args: "service")
+            let p = try confirmed(h)
+            if cancel { h.cancellation.cancel() }
+            else { h.processes.failIdentity = true }
+            _ = h.flow.execute(p, mode: .forceProcesses)
+            assertNoDiskActions(h)
+            XCTAssertTrue(h.processes.forced.isEmpty)
+        }
+    }
+
+    func testAllClosedThenExpandedScopeCanBeReconfirmedWithoutReclosing() throws {
+        for newImage in [false, true] {
+            let h = FlowHarness(); h.add(app: "editor")
+            let p = try confirmed(h)
+            h.processes.onForce = {
+                if newImage {
+                    h.images = [.init(path: FlowHarness.mount + "/new.dmg", writable: true,
+                                      devEntries: ["/dev/disk91"], mountPoints: [])]
+                } else { h.add(pid: 789) }
+            }
+            guard case .preview(let review) = h.flow.execute(p, mode: .forceProcesses) else { return XCTFail("expanded scope") }
+            XCTAssertTrue(review.selectedForceProcesses.isEmpty)
+            XCTAssertEqual(review.forceProcessConfirmation, .closeAndEject)
+            XCTAssertTrue(review.canForceProcesses)
+            assertNoDiskActions(h)
+            guard case .ejected(_, let apps, _, _) = h.flow.execute(review, mode: .forceProcesses) else { return XCTFail("reconfirmed disk only") }
+            XCTAssertEqual(apps, 1)
+            XCTAssertEqual(h.processes.forced, [123])
+        }
+    }
+
+    func testZeroSelectionCloseOnlyAndWrongExecutionModesHaveNoEffects() throws {
+        let h = FlowHarness(); h.add(executable: "/usr/libexec/service", args: "service")
+        let p = try confirmed(h, action: .closeOnly)
+        _ = h.flow.execute(p, mode: .forceProcesses)
+        _ = h.flow.execute(p, mode: .prepared)
+        _ = h.flow.execute(p, mode: .force)
+        assertNoDiskActions(h)
+        XCTAssertTrue(h.processes.forced.isEmpty)
+    }
+
+    func testPostUnmountScanFailureRequiresFreshProofVolumesRemainUnmounted() throws {
+        for state in ["unmounted", "remounted", "unknown"] {
+            let h = FlowHarness(); h.add(app: "editor")
+            let p = try confirmed(h)
+            let f = h.flow
+            f.onSystemReturned = {
+                guard h.targetInspector.unmounted else { return }
+                h.failures["lsof -nP +w -F pcLfn +f -- " + FlowHarness.mount] =
+                    .init(stdout: Data(), stderr: "filesystem unavailable", exitCode: 1)
+                if state == "remounted" { h.targetInspector.unmounted = false }
+                if state == "unknown" { h.targetInspector.verifyError = true }
+            }
+            let result = f.execute(p, mode: .forceProcesses)
+            if state == "unmounted" {
+                guard case .ejected = result else { return XCTFail("verified unmounted target can finish") }
+                XCTAssertTrue(h.calls.contains("diskutil eject disk90"))
+            } else {
+                guard case .preview(let review) = result else { return XCTFail("unknown scope must stop: \(state)") }
+                XCTAssertTrue(review.incomplete)
+                XCTAssertFalse(h.calls.contains("diskutil eject disk90"))
+            }
+        }
+    }
+
+    func testForcedImageFailureRetainsProcessHistoryInDiagnostic() throws {
+        let h = FlowHarness(); h.add(app: "editor")
+        h.images = [.init(path: FlowHarness.mount + "/a.dmg", writable: true, devEntries: ["/dev/disk91"], mountPoints: [])]
+        h.detachWorks = false
+        let f = h.flow, p = try confirmed(h)
+        guard case .aborted = f.execute(p, mode: .forceProcesses) else { return XCTFail("failed detach") }
+        XCTAssertEqual(f.lastFailure?.forceRequested.count, 1)
+        XCTAssertTrue(f.lastFailure?.forceUsed == true)
+        guard case .preview(let retry) = h.flow.prepareForce(try XCTUnwrap(f.lastFailure)) else { return XCTFail("legacy disk retry") }
+        h.detachWorks = true
+        guard case .ejected = h.flow.execute(retry, mode: .force) else { return XCTFail("disk retry") }
+        XCTAssertEqual(h.processes.forced, [123])
+    }
+}
diff --git a/Tests/DevDiskKitTests/PanelLayoutTests.swift b/Tests/DevDiskKitTests/PanelLayoutTests.swift
new file mode 100644
index 0000000..6c9f176
--- /dev/null
+++ b/Tests/DevDiskKitTests/PanelLayoutTests.swift
@@ -0,0 +1,21 @@
+import XCTest
+@testable import DevDiskKit
+
+final class PanelLayoutTests: XCTestCase {
+    func testExpandedFooterKeepsWindowWithinAvailableHeight() {
+        let available: CGFloat = 923
+        let chrome: CGFloat = 320
+        let body = UI.boundedBodyHeight(preferred: 703, available: available, chrome: chrome)
+        XCTAssertEqual(body, 555)
+        XCTAssertLessThanOrEqual(body + chrome + 48, available)
+    }
+
+    func testPopoverStillUsesPreferredCapOnLargeDisplay() {
+        XCTAssertEqual(UI.boundedBodyHeight(preferred: 520, available: 1400, chrome: 320), 520)
+    }
+
+    func testShortScreenShrinksBodyRatherThanHidingActions() {
+        XCTAssertEqual(UI.boundedBodyHeight(preferred: 520, available: 600, chrome: 330), 222)
+        XCTAssertEqual(UI.boundedBodyHeight(preferred: 520, available: 300, chrome: 330), 1)
+    }
+}
diff --git a/Tests/DevDiskKitTests/StoreReliabilityTests.swift b/Tests/DevDiskKitTests/StoreReliabilityTests.swift
index 38d017e..59cbd39 100644
--- a/Tests/DevDiskKitTests/StoreReliabilityTests.swift
+++ b/Tests/DevDiskKitTests/StoreReliabilityTests.swift
@@ -12,6 +12,119 @@ final class StoreReliabilityTests: XCTestCase {
         subscription?.cancel()
     }
 
+    func testFullForceSelectionAndSeparateConfirmationAreReadOnlyUntilConfirmed() async {
+        let h = FlowHarness(); h.add(pid: 101, app: "editor"); h.add(pid: 102)
+        h.add(pid: 103, executable: "/bin/zsh", args: "zsh")
+        h.add(pid: 104, executable: "/usr/libexec/service", args: "service")
+        let store = DiskStore(runner: h, defaults: defaults(), start: false)
+        store.applyDiscovery([drive("ReviewDisk", uuid: "review-uuid")])
+        store.makeFlow = { _, _, token in h.cancellation = token; return h.flow }
+        store.eject(); await wait(store, for: .awaitingConfirmation)
+        XCTAssertTrue(store.ejectPlan?.selectedForceProcesses.isEmpty == true)
+        store.selectAllForceProcesses(true)
+        XCTAssertEqual(Set(store.ejectPlan!.selectedForceProcesses.map(\.pid)), [101, 102, 103])
+        XCTAssertTrue(store.ejectPlan?.selectedTasks.isEmpty == true, "Force selection must not authorize TERM")
+        store.selectAllForceProcesses(false)
+        XCTAssertTrue(store.ejectPlan?.selectedForceProcesses.isEmpty == true)
+        store.selectForceProcess(h.processes.live[104]!, selected: true)
+        XCTAssertTrue(store.ejectPlan?.selectedForceProcesses.isEmpty == true)
+        store.selectAllForceProcesses(true)
+        store.confirmEject(mode: .forceProcesses)
+        XCTAssertEqual(store.operation, .awaitingConfirmation)
+        XCTAssertTrue(h.processes.forced.isEmpty)
+        store.requestForceProcesses(.closeOnly)
+        await wait(store, for: .awaitingConfirmation)
+        XCTAssertEqual(store.ejectPlan?.forceProcessConfirmation, .closeOnly)
+        store.selectAllForceProcesses(false)
+        XCTAssertEqual(store.ejectPlan?.selectedForceProcesses.count, 3, "confirmation freezes selection")
+        XCTAssertTrue(h.processes.forced.isEmpty)
+        store.cancelForceProcessConfirmation()
+        XCTAssertNil(store.ejectPlan?.forceProcessConfirmation)
+        store.requestForceProcesses(.closeOnly)
+        await wait(store, for: .awaitingConfirmation)
+        store.confirmEject(mode: .forceProcesses)
+        store.confirmEject(mode: .forceProcesses)
+        await wait(store, for: .awaitingConfirmation)
+        XCTAssertEqual(h.processes.forced, [101, 102, 103])
+        XCTAssertEqual(store.forceProcessRequestCount, 3)
+        XCTAssertFalse(store.forceWasUsed)
+        XCTAssertEqual(store.ejectPlan?.completedApps, 1)
+        XCTAssertEqual(store.ejectPlan?.completedDaemons, 2)
+        XCTAssertFalse(h.calls.contains { $0.hasPrefix("diskutil eject") || $0.hasPrefix("diskutil unmountDisk") })
+    }
+
+    func testSystemOnlyOccupancyOpensPreviewAndZeroSelectionCanConfirmDirectForce() async {
+        let h = FlowHarness(); h.add(executable: "/usr/libexec/service", args: "service")
+        let store = DiskStore(runner: h, defaults: defaults(), start: false)
+        store.applyDiscovery([drive("ReviewDisk", uuid: "review-uuid")])
+        store.makeFlow = { _, _, token in h.cancellation = token; return h.flow }
+        store.eject(); await wait(store, for: .awaitingConfirmation)
+        XCTAssertFalse(h.calls.contains("diskutil eject disk90"))
+        XCTAssertTrue(store.ejectPlan?.selectedForceProcesses.isEmpty == true)
+        store.requestForceProcesses(.closeOnly)
+        XCTAssertEqual(store.operation, .awaitingConfirmation)
+        XCTAssertNil(store.ejectPlan?.forceProcessConfirmation)
+        store.requestForceProcesses(.closeAndEject); await wait(store, for: .awaitingConfirmation)
+        XCTAssertEqual(store.ejectPlan?.forceProcessConfirmation, .closeAndEject)
+        XCTAssertFalse(h.calls.contains("diskutil unmountDisk force disk90"))
+        store.confirmEject(mode: .forceProcesses); await wait(store, for: .finished)
+        guard case .ejected = store.screen else { return XCTFail("disk-only force") }
+        XCTAssertTrue(store.forceWasUsed); XCTAssertEqual(store.forceProcessRequestCount, 0)
+        XCTAssertTrue(h.processes.forced.isEmpty)
+    }
+
+    func testDirectJointConfirmationAfterCloseOnlyDoesNotRepeatProcessActions() async {
+        let h = FlowHarness(); h.add(app: "editor")
+        let store = DiskStore(runner: h, defaults: defaults(), start: false)
+        store.applyDiscovery([drive("ReviewDisk", uuid: "review-uuid")])
+        store.makeFlow = { _, _, token in h.cancellation = token; return h.flow }
+        store.eject(); await wait(store, for: .awaitingConfirmation)
+        store.selectAllForceProcesses(true)
+        store.requestForceProcesses(.closeOnly); await wait(store, for: .awaitingConfirmation)
+        store.confirmEject(mode: .forceProcesses); await wait(store, for: .awaitingConfirmation)
+        XCTAssertEqual(store.forceProcessRequestCount, 1)
+        store.requestForceProcesses(.closeAndEject); await wait(store, for: .awaitingConfirmation)
+        XCTAssertTrue(store.ejectPlan?.selectedForceProcesses.isEmpty == true)
+        XCTAssertFalse(h.calls.contains("diskutil unmountDisk force disk90"))
+        store.confirmEject(mode: .forceProcesses)
+        store.confirmEject(mode: .forceProcesses)
+        await wait(store, for: .finished)
+        guard case .ejected = store.screen else { return XCTFail("ejected") }
+        XCTAssertTrue(store.forceWasUsed)
+        XCTAssertEqual(store.forceProcessRequestCount, 1)
+        XCTAssertEqual(h.processes.forced, [123])
+        XCTAssertEqual(h.calls.filter { $0 == "diskutil unmountDisk force disk90" }.count, 1)
+    }
+
+    func testJointForceIgnoresItsOwnDelayedUnmountNotificationBeforeFinalEject() async {
+        let h = FlowHarness(); h.add(app: "editor")
+        let store = DiskStore(runner: h, defaults: defaults(), start: false)
+        store.applyDiscovery([drive("ReviewDisk", uuid: "review-uuid")])
+        store.makeFlow = { _, _, token in h.cancellation = token; return h.flow }
+        store.eject(); await wait(store, for: .awaitingConfirmation)
+        store.selectAllForceProcesses(true)
+        store.requestForceProcesses(.closeAndEject); await wait(store, for: .awaitingConfirmation)
+        let reached = expectation(description: "after unmount, before final eject")
+        let resume = DispatchSemaphore(value: 0)
+        var intercepted = false
+        h.targetInspector.beforeRead = {
+            if h.targetInspector.unmounted && !h.cancellation.isCommitted && !intercepted {
+                intercepted = true
+                reached.fulfill()
+                _ = resume.wait(timeout: .now() + 3)
+            }
+        }
+        store.confirmEject(mode: .forceProcesses)
+        await fulfillment(of: [reached], timeout: 2)
+        store.mountsChanged(path: FlowHarness.mount)
+        XCTAssertEqual(store.operation, .executing)
+        XCTAssertFalse(h.cancellation.isCancelled)
+        resume.signal()
+        await wait(store, for: .finished)
+        guard case .ejected = store.screen else { return XCTFail("own notification must not cancel final eject") }
+        XCTAssertEqual(h.calls.filter { $0 == "diskutil eject disk90" }.count, 1)
+    }
+
     func testTaskSelectionAndConfirmationUseSharedStoreState() async {
         let h = FlowHarness(); h.add(executable: "/bin/zsh", args: "zsh")
         let store = DiskStore(runner: h, defaults: defaults(), start: false)