diff --git a/Sources/NucleicApp/Panels/MacVMComputerSurface.swift b/Sources/NucleicApp/Panels/MacVMComputerSurface.swift
index 7c9d28a7..a57bd29e 100644
--- a/Sources/NucleicApp/Panels/MacVMComputerSurface.swift
+++ b/Sources/NucleicApp/Panels/MacVMComputerSurface.swift
@@ -209,6 +209,28 @@ final class MacVMComputerSurface: MacVMSurfaceHost {
         view.scrollWheel(with: e)
     }
 
+    /// Append the keyboard-injection preconditions for the base-build VM to a host-readable log, so a
+    /// stuck provisioning run can be diagnosed without eyes on the guest: is the VM window key, is the
+    /// VZ view first responder, is the app active? Provisioning-only (keyed off the base surface name)
+    /// and best-effort — never throws into the input path.
+    private func logHID(_ name: String, _ e: Entry, _ detail: String) {
+        guard name == MacVMEngine.baseProvisionSurfaceName else { return }
+        let keyWin = e.window.isKeyWindow
+        let vzFirstResponder = (e.window.firstResponder === e.view)
+        let line = "\(Date()) \(detail) | keyWindow=\(keyWin) vzFirstResponder=\(vzFirstResponder) "
+            + "appActive=\(NSApp.isActive) onScreen=\(e.window.isOnActiveSpace && e.window.isVisible)\n"
+        let url = URL(fileURLWithPath: NSTemporaryDirectory())
+            .appendingPathComponent("nucleic-hid-diag.log")
+        guard let data = line.data(using: .utf8) else { return }
+        if let fh = try? FileHandle(forWritingTo: url) {
+            defer { try? fh.close() }
+            fh.seekToEndOfFile()
+            fh.write(data)
+        } else {
+            try? data.write(to: url)
+        }
+    }
+
     private func postStroke(_ s: MacVMKeyStroke) {
         // Two things are load-bearing here:
         //  • CGEvent backing — `VZVirtualMachineView` derives the guest HID scancode from the event's