humanish 0.106.0 → 0.107.0

package/dist/analysis/execute.js

@@ -8,6 +8,8 @@ import { ANALYSIS_ID_PATTERN, ANALYSIS_SCHEMA, } from "./types.js";
 import { INPUT_IMAGE_DATA_URL, createAnalysisProvider, } from "./provider.js";
 import { checkAnalysisResult, hashAnalysisValue, analysisResponseSchema, analysisResultJsonSchema, validateAnalysisInputMetadata, } from "./validation.js";
 import { EVIDENCE_LIMITS } from "./evidence.js";
+import { truncatedFrameWarning, unknownNotificationsWarning, } from "../actors/codex/restricted-notifications.js";
+import { protocolAdditionsWarning, protocolIncompatibilityMessage, } from "../actors/codex/protocol-compat.js";
 export const ANALYSIS_PROMPT_VERSION = "study-evidence-6";
 const SUPPORTED_ANALYSIS_MODELS = Object.freeze([
     "gpt-6-astra",
@@ -119,7 +121,7 @@ function inputError(input) {
     return null;
 }
 /**
- * Local admission ESTIMATE, not a provider-enforced billed-spend guarantee. No token-count API
+ * Local admission estimate, not a provider-enforced billed-spend guarantee. No token-count API
  * call, credential, or network access. One UTF-8 byte/token for all text/schema plus framing is
  * intentionally conservative. Each high-detail image is priced from its PNG size by the vision
  * guide's patch formula (see image-tokens.ts), or at the 3,000-token ceiling when its size or the
@@ -296,26 +298,33 @@ const VALIDATION_FAILURES = Object.freeze({
 function checkProviderAnalysis(input, value) {
     try {
         const parsed = analysisResponseSchema.safeParse(value);
-        if (!parsed.success)
-            return { ok: false, error: VALIDATION_FAILURES.ANALYSIS_RESULT_SCHEMA_INVALID };
+        if (!parsed.success) {
+            const error = VALIDATION_FAILURES.ANALYSIS_RESULT_SCHEMA_INVALID;
+            return { ok: false, error, rejected: { error, errors: [], output: value } };
+        }
         let scrubbed;
         try {
             scrubbed = scrubGeneratedNarrative(parsed.data);
         }
         catch (error) {
+            if (!(error instanceof Error && error.message === "ANALYSIS_TRANSIENT_SECRET_IN_STRUCTURE"))
+                return { ok: false, error: "analysis_validation_failed_unexpected" };
+            const rejected = "analysis_validation_failed_scrub_rejected";
             return {
                 ok: false,
-                error: error instanceof Error && error.message === "ANALYSIS_TRANSIENT_SECRET_IN_STRUCTURE"
-                    ? "analysis_validation_failed_scrub_rejected"
-                    : "analysis_validation_failed_unexpected",
+                error: rejected,
+                rejected: { error: rejected, errors: [], output: value },
             };
         }
         const checked = checkAnalysisResult(input, scrubbed);
-        if (!checked.ok)
+        if (!checked.ok) {
+            const error = VALIDATION_FAILURES[checked.errors[0] ?? ""] ?? "analysis_validation_failed_unexpected";
             return {
                 ok: false,
-                error: VALIDATION_FAILURES[checked.errors[0] ?? ""] ?? "analysis_validation_failed_unexpected",
+                error,
+                rejected: { error, errors: [...checked.errors], output: scrubbed },
             };
+        }
         return checked;
     }
     catch {
@@ -403,14 +412,21 @@ function recordProviderUsage(artifact, config, response) {
 /**
  * Settle a completed response. Parse the bounded shape first, then scrub and validate again.
  * Changed exact quotes or expanded field lengths fail closed under the original validator; source
- * bytes stay intact. Only an allowlisted stage or first rule code survives; rejected output and
- * exceptions do not.
+ * bytes stay intact. Only an allowlisted stage or first rule code reaches the artifact; rejected
+ * output goes to the caller's diagnostic callback and exceptions go nowhere.
  */
-function settleCompletedOutput(artifact, input, config, admission, response) {
+function settleCompletedOutput(artifact, input, config, admission, response, onRejectedOutput) {
     const checked = checkProviderAnalysis(input, response.output);
     if (!checked.ok) {
         artifact.result = null;
         artifact.error = checked.error;
+        if (checked.rejected)
+            try {
+                onRejectedOutput?.(checked.rejected);
+            }
+            catch {
+                /* Diagnosis does not own the attempt's outcome. */
+            }
         return;
     }
     artifact.result = checked.result;
@@ -493,12 +509,23 @@ export async function runAnalysis(input, config, options) {
         ...(options.signal === undefined ? {} : { signal: options.signal }),
     });
     recordProviderUsage(artifact, config, response);
+    if (config.provider === "codex")
+        for (const warning of [
+            response.protocolIncompatibilities === undefined
+                ? undefined
+                : protocolIncompatibilityMessage(config.identity.cliVersion, response.protocolIncompatibilities),
+            protocolAdditionsWarning(config.identity.cliVersion, response.protocolAdditions),
+            unknownNotificationsWarning(response.unknownNotifications, config.identity.cliVersion),
+            truncatedFrameWarning(response.truncatedFrameBytes),
+        ])
+            if (warning !== undefined)
+                options.warnings?.push(warning);
     if (response.status !== "completed") {
         artifact.status = response.status === "cancelled" ? "cancelled" : "failed";
         artifact.error = `analysis_${response.errorCode ?? "provider_failed"}`;
         return finish();
     }
     progress("validating");
-    settleCompletedOutput(artifact, input, config, admission, response);
+    settleCompletedOutput(artifact, input, config, admission, response, options.onRejectedOutput);
     return finish();
 }

package/dist/analysis/job.d.ts

@@ -21,6 +21,8 @@ export interface AutomaticAnalysisCancellation {
     requested: boolean;
     reason: string | null;
 }
+/** A route's reason not to analyze a run it recorded, persisted as the job's skip reason. */
+export type AutomaticAnalysisRefusal = "AUTOMATIC_ANALYSIS_CLEANUP_UNCONFIRMED";
 declare const jobSchema: z.ZodObject<{
     schema: z.ZodLiteral<"humanish.automatic-study-analysis.v1">;
     runId: z.ZodString;
@@ -45,6 +47,7 @@ declare const jobSchema: z.ZodObject<{
         AUTOMATIC_ANALYSIS_BUSY: "AUTOMATIC_ANALYSIS_BUSY";
         AUTOMATIC_ANALYSIS_CANCELLATION_UNAVAILABLE: "AUTOMATIC_ANALYSIS_CANCELLATION_UNAVAILABLE";
         AUTOMATIC_ANALYSIS_CANCELLED: "AUTOMATIC_ANALYSIS_CANCELLED";
+        AUTOMATIC_ANALYSIS_CLEANUP_UNCONFIRMED: "AUTOMATIC_ANALYSIS_CLEANUP_UNCONFIRMED";
         AUTOMATIC_ANALYSIS_CODEX_UNAVAILABLE: "AUTOMATIC_ANALYSIS_CODEX_UNAVAILABLE";
         AUTOMATIC_ANALYSIS_FAILED: "AUTOMATIC_ANALYSIS_FAILED";
         AUTOMATIC_ANALYSIS_KEY_MISSING: "AUTOMATIC_ANALYSIS_KEY_MISSING";
@@ -69,9 +72,9 @@ declare const jobSchema: z.ZodObject<{
 }, z.core.$strict>;
 type JobRecord = z.infer<typeof jobSchema>;
 /** Also guards direct HTML projection callers, not only the contained-file reader. */
-export declare function projectAutomaticStudyAnalysisView(value: unknown): AutomaticAnalysisView | undefined;
+export declare function projectAutomaticAnalysisView(value: unknown): AutomaticAnalysisView | undefined;
 /** Minimal historical accounting, without source validation, execution or liveness inference. */
-export declare function readAutomaticStudyAnalysisAccounting(prepared: PreparedRunArtifactPaths): Promise<{
+export declare function readAutomaticAnalysisAccounting(prepared: PreparedRunArtifactPaths): Promise<{
     attemptId: string;
     analysisId: string | null;
     started: boolean;
@@ -79,7 +82,7 @@ export declare function readAutomaticStudyAnalysisAccounting(prepared: PreparedR
     uncertain: boolean;
 } | "unknown" | undefined>;
 /** Read-only projection. A stale timestamp or persisted claim never authorizes execution. */
-export declare function readAutomaticStudyAnalysisPrepared(prepared: PreparedRunArtifactPaths, now?: number): Promise<AutomaticAnalysisView | undefined>;
+export declare function readAutomaticAnalysisPrepared(prepared: PreparedRunArtifactPaths, now?: number): Promise<AutomaticAnalysisView | undefined>;
 export interface AutomaticAnalysisJob {
     readonly attemptId: string;
     /** Serialized, awaited durability boundary. A failed write must prevent dispatch. */
@@ -88,10 +91,10 @@ export interface AutomaticAnalysisJob {
     cancellationRequested(): Promise<boolean>;
 }
 /** The directory is permanent, including after interrupted/failed writes. Never re-open it as a writer. */
-export declare function claimAutomaticStudyAnalysis(prepared: PreparedRunArtifactPaths, metadata: {
+export declare function claimAutomaticAnalysis(prepared: PreparedRunArtifactPaths, metadata: {
     configDigest: string;
     promptVersion: string;
 }): Promise<AutomaticAnalysisJob | null>;
 /** A scoped cancellation request, never a PID signal and never permission to create a new job. */
-export declare function requestAutomaticStudyAnalysisCancellationPrepared(prepared: PreparedRunArtifactPaths): Promise<AutomaticAnalysisCancellation>;
+export declare function requestAutomaticAnalysisCancellationPrepared(prepared: PreparedRunArtifactPaths): Promise<AutomaticAnalysisCancellation>;
 export {};

package/dist/analysis/job.js

@@ -4,10 +4,10 @@ import path from "node:path";
 import { z } from "zod";
 import { physicalCwdOf, runIdOf, validatePreparedRunRootIdentity, } from "../run/paths.js";
 import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, prepareContainedOutputDirectoryRoot, writeContainedOutputFile, } from "../run/contained-output.js";
-import { pathMissing, readBoundedStudyFile } from "../run/study-files.js";
+import { pathMissing, readBoundedFile } from "../run/evidence-files.js";
 import { containsSensitive } from "../evidence/redaction.js";
-import { readStudyAnalysisVersion } from "./store.js";
-import { readStudyAnalysisExecution } from "./store-executions.js";
+import { readAnalysisVersion } from "./store.js";
+import { readAnalysisExecution } from "./store-executions.js";
 import { hashAnalysisValue } from "./validation.js";
 import { ANALYSIS_ID_PATTERN, SHA256_HEX_PATTERN } from "./types.js";
 export const AUTOMATIC_ANALYSIS_DIRECTORY = "analysis-automatic";
@@ -47,6 +47,7 @@ const reasons = [
     "AUTOMATIC_ANALYSIS_ADMISSION_EXCEEDED",
     "AUTOMATIC_ANALYSIS_ACTOR_CANCELLED",
     "AUTOMATIC_ANALYSIS_NO_PARTICIPANT_EVIDENCE",
+    "AUTOMATIC_ANALYSIS_CLEANUP_UNCONFIRMED",
 ];
 const id = z.string().regex(ANALYSIS_ID_PATTERN);
 const date = z.iso.datetime();
@@ -106,7 +107,7 @@ function parseJob(bytes, runId) {
     return record;
 }
 /** Also guards direct HTML projection callers, not only the contained-file reader. */
-export function projectAutomaticStudyAnalysisView(value) {
+export function projectAutomaticAnalysisView(value) {
     if (value === undefined)
         return undefined;
     const parsed = jobSchema
@@ -123,12 +124,12 @@ async function bindJob(prepared) {
     return root ? Object.freeze({ ...root, parentRun: prepared }) : null;
 }
 /** Minimal historical accounting, without source validation, execution or liveness inference. */
-export async function readAutomaticStudyAnalysisAccounting(prepared) {
+export async function readAutomaticAnalysisAccounting(prepared) {
     try {
         const root = await bindJob(prepared);
         if (!root)
             return undefined;
-        const bytes = await readBoundedStudyFile(root, JOB_FILE, MAX_JOB_BYTES);
+        const bytes = await readBoundedFile(root, JOB_FILE, MAX_JOB_BYTES);
         if (!bytes)
             return "unknown";
         const record = parseJob(bytes, runIdOf(prepared));
@@ -145,14 +146,14 @@ export async function readAutomaticStudyAnalysisAccounting(prepared) {
     }
 }
 /** Read-only projection. A stale timestamp or persisted claim never authorizes execution. */
-export async function readAutomaticStudyAnalysisPrepared(prepared, now = Date.now()) {
+export async function readAutomaticAnalysisPrepared(prepared, now = Date.now()) {
     try {
         const root = await bindJob(prepared);
         if (!root) {
             const missing = await pathMissing(path.join(prepared.physicalRunRoot, AUTOMATIC_ANALYSIS_DIRECTORY));
             return missing ? undefined : unknown();
         }
-        const bytes = await readBoundedStudyFile(root, JOB_FILE, MAX_JOB_BYTES);
+        const bytes = await readBoundedFile(root, JOB_FILE, MAX_JOB_BYTES);
         if (!bytes)
             return unknown();
         const record = parseJob(bytes, runIdOf(prepared));
@@ -185,7 +186,7 @@ async function terminalResultMatches(prepared, record) {
         value.inputDigest === record.inputDigest &&
         value.configDigest === record.configDigest &&
         value.promptVersion === record.promptVersion;
-    const receipt = await readStudyAnalysisExecution(prepared, record.analysisId);
+    const receipt = await readAnalysisExecution(prepared, record.analysisId);
     if (!receipt || !matches(receipt) || hashAnalysisValue(receipt) !== record.receiptSha256)
         return false;
     if (record.state === "failed" && record.reason === "AUTOMATIC_ANALYSIS_PUBLICATION_FAILED")
@@ -194,7 +195,7 @@ async function terminalResultMatches(prepared, record) {
         return false;
     if (record.state === "failed" || record.state === "cancelled")
         return true;
-    const entry = await readStudyAnalysisVersion(prepared, record.analysisId);
+    const entry = await readAnalysisVersion(prepared, record.analysisId);
     return (entry?.state === "ready" &&
         entry.analysis !== null &&
         matches(entry.analysis) &&
@@ -202,7 +203,7 @@ async function terminalResultMatches(prepared, record) {
         hashAnalysisValue(entry.analysis) === record.analysisSha256);
 }
 /** The directory is permanent, including after interrupted/failed writes. Never re-open it as a writer. */
-export async function claimAutomaticStudyAnalysis(prepared, metadata) {
+export async function claimAutomaticAnalysis(prepared, metadata) {
     await validatePreparedRunRootIdentity(prepared);
     const target = path.join(prepared.physicalRunRoot, AUTOMATIC_ANALYSIS_DIRECTORY);
     try {
@@ -271,7 +272,7 @@ export async function claimAutomaticStudyAnalysis(prepared, metadata) {
         touch: () => update({}),
         async cancellationRequested() {
             await assertPreparedSelectedOutputDirectory(root);
-            const bytes = await readBoundedStudyFile(root, CANCEL_FILE, MAX_CANCEL_BYTES);
+            const bytes = await readBoundedFile(root, CANCEL_FILE, MAX_CANCEL_BYTES);
             if (!bytes) {
                 if (!(await pathMissing(path.join(root.physicalPath, CANCEL_FILE))))
                     throw new Error("AUTOMATIC_ANALYSIS_CANCELLATION_UNAVAILABLE");
@@ -285,12 +286,12 @@ export async function claimAutomaticStudyAnalysis(prepared, metadata) {
     };
 }
 /** A scoped cancellation request, never a PID signal and never permission to create a new job. */
-export async function requestAutomaticStudyAnalysisCancellationPrepared(prepared) {
+export async function requestAutomaticAnalysisCancellationPrepared(prepared) {
     try {
         const root = await bindJob(prepared);
         if (!root)
             return { requested: false, reason: "AUTOMATIC_ANALYSIS_SOURCE_UNAVAILABLE" };
-        const bytes = await readBoundedStudyFile(root, JOB_FILE, MAX_JOB_BYTES);
+        const bytes = await readBoundedFile(root, JOB_FILE, MAX_JOB_BYTES);
         if (!bytes)
             throw new Error("Unavailable job.");
         const record = parseJob(bytes, runIdOf(prepared));

package/dist/analysis/load.d.ts

@@ -1,3 +1,3 @@
 import type { PreparedRunArtifactPaths } from "../run/paths.js";
 import type { LoadedAnalysis } from "./types.js";
-export declare function loadStudyAnalysis(prepared: PreparedRunArtifactPaths, id?: string): Promise<LoadedAnalysis>;
+export declare function loadAnalysis(prepared: PreparedRunArtifactPaths, id?: string): Promise<LoadedAnalysis>;

package/dist/analysis/load.js

@@ -1,11 +1,11 @@
 // Loads a run's study analysis together with the automatic analysis job's view of it. The store
 // and the job module each stay importable without the other.
-import { readAutomaticStudyAnalysisPrepared } from "./job.js";
-import { loadStudyAnalysisRecord } from "./store.js";
-export async function loadStudyAnalysis(prepared, id) {
+import { readAutomaticAnalysisPrepared } from "./job.js";
+import { loadAnalysisRecord } from "./store.js";
+export async function loadAnalysis(prepared, id) {
     const [loaded, automatic] = await Promise.all([
-        loadStudyAnalysisRecord(prepared, id),
-        readAutomaticStudyAnalysisPrepared(prepared),
+        loadAnalysisRecord(prepared, id),
+        readAutomaticAnalysisPrepared(prepared),
     ]);
     return automatic === undefined ? loaded : { ...loaded, automatic };
 }

package/dist/analysis/provider.d.ts

@@ -28,8 +28,16 @@ export interface AnalysisProviderResult {
     dispatched: boolean;
     /** Omitted preserves complete API-response accounting; account snapshots must state this. */
     usageComplete?: boolean;
-    errorCode: "invalid_request" | "provider_http_error" | "provider_network_error" | "invalid_response" | "provider_headers_timeout" | "provider_body_timeout" | "provider_connect_timeout" | "provider_connection_reset" | "provider_dns_error" | "codex_busy" | "codex_unavailable" | "codex_unsupported_version" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "response_too_large" | "output_incomplete" | "refusal" | "cancelled" | "timeout" | null;
+    errorCode: "invalid_request" | "provider_http_error" | "provider_network_error" | "invalid_response" | "provider_headers_timeout" | "provider_body_timeout" | "provider_connect_timeout" | "provider_connection_reset" | "provider_dns_error" | "codex_busy" | "codex_unavailable" | "codex_unsupported_version" | "codex_incompatible_release" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "response_too_large" | "output_incomplete" | "refusal" | "cancelled" | "timeout" | null;
     httpStatus?: number;
+    /** Codex only: notification methods humanish does not know that carried no item, by count. */
+    unknownNotifications?: Readonly<Record<string, number>>;
+    /** Codex only: bytes of a last frame cut off when humanish stopped the app-server. */
+    truncatedFrameBytes?: number;
+    /** Codex only: how the release's app-server schema differs from the fields humanish reads. */
+    protocolIncompatibilities?: readonly string[];
+    /** Codex only: schema values beyond the baseline humanish knows. */
+    protocolAdditions?: readonly string[];
 }
 export type AnalysisProvider = (request: AnalysisProviderRequest) => Promise<AnalysisProviderResult>;
 /** An input image the provider accepts; the groups are the image type and its base64 bytes. */

package/dist/analysis/restricted-codex.d.ts

@@ -16,4 +16,6 @@ export declare function checkRestrictedCodexAnalysisReadiness(input?: {
 }, options?: RestrictedCodexSessionOptions): Promise<{
     ready: boolean;
     errorCode: RestrictedCodexAnalysisErrorCode | null;
+    protocolIncompatibilities?: readonly string[];
+    protocolAdditions?: readonly string[];
 }>;

package/dist/analysis/restricted-codex.js

@@ -19,5 +19,14 @@ export async function bindCodexAnalysisCliVersion(config, detect = async () => (
 /** Does not submit a model turn. Readiness is not a quota/access guarantee. */
 export async function checkRestrictedCodexAnalysisReadiness(input = {}, options = {}) {
     const result = await checkRestrictedCodexSessionReadiness(input, options);
-    return { ready: result.status === "completed", errorCode: result.errorCode };
+    return {
+        ready: result.status === "completed",
+        errorCode: result.errorCode,
+        ...(result.protocolIncompatibilities === undefined
+            ? {}
+            : { protocolIncompatibilities: result.protocolIncompatibilities }),
+        ...(result.protocolAdditions === undefined
+            ? {}
+            : { protocolAdditions: result.protocolAdditions }),
+    };
 }

package/dist/analysis/service.d.ts

@@ -19,6 +19,8 @@ export interface AnalyzeResult {
     analysisId?: string;
     artifactPath?: string;
     executionReceiptPath?: string;
+    /** A rejected response kept for local diagnosis, outside the run directory. */
+    rejectedOutputPath?: string;
     status?: AnalysisArtifact["status"];
     usage?: AnalysisArtifact["usage"];
     admission?: AnalysisAdmission;

package/dist/analysis/service.js

@@ -10,11 +10,12 @@ import { loadRunBundlePrepared, resolveRunPath } from "../run/locate.js";
 import { physicalCwdOf, runIdOf, resolvePhysicalCwd, validatePreparedRunRootIdentity, } from "../run/paths.js";
 import { isRunStatusRecord, RUN_STATUS_FILE } from "../run/status.js";
 import { captureEvidence, EVIDENCE_LIMITS } from "./evidence.js";
-import { pathMissing, readBoundedStudyFile } from "../run/study-files.js";
+import { pathMissing, readBoundedFile } from "../run/evidence-files.js";
 import { estimateAnalysisAdmission, preferLargerAnalysisOutput, runAnalysis, ANALYSIS_PROMPT_VERSION, } from "./execute.js";
-import { appendStudyAnalysisCorrection, assertAnalysisPublicationCapacity, listAnalyses, writeStudyAnalysis, } from "./store.js";
-import { beginStudyAnalysisExecution, writeStudyAnalysisExecutionReceipt, } from "./store-executions.js";
-import { loadStudyAnalysis } from "./load.js";
+import { appendAnalysisCorrection, assertAnalysisPublicationCapacity, listAnalyses, writeAnalysis, } from "./store.js";
+import { beginAnalysisExecution, writeAnalysisExecutionReceipt } from "./store-executions.js";
+import { keepRejectedAnalysisOutput } from "./diagnostics.js";
+import { loadAnalysis } from "./load.js";
 import { hashAnalysisValue } from "./validation.js";
 import { ANALYSIS_CORRECTION_SCHEMA, } from "./types.js";
 import { RUN_BUNDLE_FILE } from "../run/bundle.js";
@@ -57,6 +58,7 @@ const codexRecovery = {
     analysis_codex_busy: "Another restricted Codex analyst or setup check is active in this process. Wait for it to finish, then explicitly retry.",
     analysis_codex_unavailable: `The qualified Codex CLI is unavailable. Install a qualified Codex CLI (${describeQualifiedCodexCliVersions()}) and sign in with a ChatGPT account, then retry --provider codex.`,
     analysis_codex_unsupported_version: `Codex account analysis requires a qualified CLI version (${describeQualifiedCodexCliVersions()}). Other versions have not passed this tool-policy contract.`,
+    analysis_codex_incompatible_release: `This Codex CLI release changed app-server protocol fields humanish reads, so no request was sent; the warnings name each change. Install a release humanish was tested with (${describeQualifiedCodexCliVersions()}), then retry.`,
     analysis_codex_unsupported_platform: "This platform has not qualified the restricted Codex account launcher.",
     analysis_codex_login_required: "Sign in to Codex with a ChatGPT account, then retry humanish analyze --provider codex --rerun.",
     analysis_codex_unsupported_auth: "Codex analysis requires ChatGPT account authentication; API-key and custom provider authentication are not used as fallbacks.",
@@ -140,7 +142,7 @@ export async function withAnalysisLock(prepared, action) {
 }
 /** The completion gate: the run verifies, is live and finished, and has participants. */
 export async function readCompletedAnalysisSource(cwd, prepared) {
-    const bytes = await readBoundedStudyFile(prepared, RUN_BUNDLE_FILE, EVIDENCE_LIMITS.sourceBytes);
+    const bytes = await readBoundedFile(prepared, RUN_BUNDLE_FILE, EVIDENCE_LIMITS.sourceBytes);
     if (!bytes)
         throw new Error("ANALYSIS_SOURCE_UNAVAILABLE");
     const verified = await verifyRunPrepared(cwd, runIdOf(prepared), prepared);
@@ -151,7 +153,7 @@ export async function readCompletedAnalysisSource(cwd, prepared) {
         throw new Error("ANALYSIS_NO_PARTICIPANTS");
     if (loaded.bundle.mode !== "live")
         throw new Error("ANALYSIS_REQUIRES_LIVE_RUN");
-    const statusBytes = await readBoundedStudyFile(prepared, RUN_STATUS_FILE, MAX_STATUS_BYTES);
+    const statusBytes = await readBoundedFile(prepared, RUN_STATUS_FILE, MAX_STATUS_BYTES);
     if (!statusBytes) {
         const missing = await pathMissing(path.join(prepared.physicalRunRoot, RUN_STATUS_FILE)).catch(() => {
             throw new Error("ANALYSIS_SOURCE_UNAVAILABLE");
@@ -258,9 +260,9 @@ async function publishAttempt(prepared, analysis, result, finalizeExecution) {
         if (finalizeExecution)
             await finalizeExecution(analysis);
         else
-            await writeStudyAnalysisExecutionReceipt(prepared, analysis);
+            await writeAnalysisExecutionReceipt(prepared, analysis);
         result.executionReceiptPath = path.join(prepared.relativeRunRoot, "analysis-attempts", analysis.id, "receipt.json");
-        await writeStudyAnalysis(prepared, analysis);
+        await writeAnalysis(prepared, analysis);
         result.artifactPath = path.join(prepared.relativeRunRoot, "analysis", analysis.id, "analysis.json");
         return true;
     }
@@ -308,19 +310,36 @@ async function executeAnalysis(attempt) {
     if (config.provider !== "codex" && !apiKey.trim())
         return { ...fail(input.runId, false, "ANALYSIS_API_KEY_MISSING"), admission };
     let finalizeExecution;
+    const rejection = {};
     const analysis = await runAnalysis(input, config, {
         apiKey,
         ...(deps.codexProvider === undefined ? {} : { codexProvider: deps.codexProvider }),
         ...(deps.analysisId === undefined ? {} : { analysisId: deps.analysisId }),
         beforeDispatch: async (context) => {
             await deps.beforeDispatch?.(context);
-            finalizeExecution = await beginStudyAnalysisExecution(prepared, context);
+            finalizeExecution = await beginAnalysisExecution(prepared, context);
         },
         ...(deps.signal === undefined ? {} : { signal: deps.signal }),
         ...(deps.onProgress === undefined ? {} : { onProgress: deps.onProgress }),
         ...(deps.fetch === undefined ? {} : { fetch: deps.fetch }),
+        warnings: base.warnings,
+        onRejectedOutput: (output) => {
+            rejection.output = output;
+        },
     });
     const result = attemptResult(base, analysis);
+    if (rejection.output)
+        try {
+            result.rejectedOutputPath = await keepRejectedAnalysisOutput(cwd, {
+                runId: analysis.runId,
+                analysisId: analysis.id,
+                model: config.model,
+                promptVersion: analysis.promptVersion,
+            }, rejection.output);
+        }
+        catch {
+            result.warnings.push("The rejected analyst output could not be kept under .humanish/analysis-diagnostics.");
+        }
     if (!(await publishAttempt(prepared, analysis, result, finalizeExecution)))
         return {
             ...result,
@@ -365,7 +384,7 @@ export async function analyzeRun(cwdInput, run, options, deps = {}) {
 export async function showAnalysis(cwd, run, id) {
     const prepared = await resolveRunPath(await resolvePhysicalCwd(cwd), run).catch(() => null);
     return prepared
-        ? loadStudyAnalysis(prepared, id)
+        ? loadAnalysis(prepared, id)
         : { state: "invalid", analysis: null, corrections: [], warnings: ["ANALYSIS_RUN_NOT_FOUND"] };
 }
 export async function correctAnalysis(cwd, run, options) {
@@ -373,7 +392,7 @@ export async function correctAnalysis(cwd, run, options) {
     if (!prepared)
         throw new Error("ANALYSIS_RUN_NOT_FOUND");
     return withAnalysisLock(prepared, async () => {
-        const loaded = await loadStudyAnalysis(prepared, options.analysisId);
+        const loaded = await loadAnalysis(prepared, options.analysisId);
         const analysis = loaded.analysis;
         const finding = analysis?.result?.findings.find((item) => item.id === options.findingId);
         if (loaded.state !== "ready" || !analysis || !finding)
@@ -392,7 +411,7 @@ export async function correctAnalysis(cwd, run, options) {
             reason: options.reason,
             replacementClaim: options.replacementClaim ?? null,
         };
-        await appendStudyAnalysisCorrection(prepared, correction);
+        await appendAnalysisCorrection(prepared, correction);
         await refreshObserver(cwd, runIdOf(prepared), prepared);
         return correction;
     });

package/dist/analysis/sharing.d.ts

@@ -1,9 +1,9 @@
 import type { LoadedAnalysis } from "./types.js";
 /** True for the analysis record files, matched by name inside their directories. Any other file
  * under analysis/ is ordinary evidence and follows the ordinary evidence policy. */
-export declare function isStudyAnalysisRecordPath(relativePath: string): boolean;
+export declare function isAnalysisRecordPath(relativePath: string): boolean;
 /** Check the exact in-memory snapshot being projected; a prior filesystem scan cannot approve a later write. */
-export declare function studyAnalysisSharingProblems(loaded: LoadedAnalysis): {
+export declare function analysisSharingProblems(loaded: LoadedAnalysis): {
     sensitive: boolean;
     unverified: boolean;
 };

package/dist/analysis/sharing.js

@@ -1,9 +1,9 @@
 import { containsSensitive } from "../evidence/redaction.js";
-import { AUTOMATIC_ANALYSIS_DIRECTORY, projectAutomaticStudyAnalysisView } from "./job.js";
+import { AUTOMATIC_ANALYSIS_DIRECTORY, projectAutomaticAnalysisView } from "./job.js";
 import { ANALYSIS_DIRECTORY, ANALYSIS_EXECUTION_DIRECTORY } from "./store.js";
 /** True for the analysis record files, matched by name inside their directories. Any other file
  * under analysis/ is ordinary evidence and follows the ordinary evidence policy. */
-export function isStudyAnalysisRecordPath(relativePath) {
+export function isAnalysisRecordPath(relativePath) {
     const parts = relativePath.split("/");
     const leaf = parts.at(-1);
     const directory = parts[0];
@@ -14,7 +14,7 @@ export function isStudyAnalysisRecordPath(relativePath) {
             leaf.startsWith(".humanish-write-")));
 }
 /** Check the exact in-memory snapshot being projected; a prior filesystem scan cannot approve a later write. */
-export function studyAnalysisSharingProblems(loaded) {
+export function analysisSharingProblems(loaded) {
     // Job metadata never approves evidence, nor does uncertain liveness revoke its approval.
     const { automatic: _automatic, ...evidence } = loaded;
     const benignAttempt = loaded.analysis?.result === null &&
@@ -30,9 +30,9 @@ export function studyAnalysisSharingProblems(loaded) {
 /** Unsafe generated text is quarantined without hiding the original recording. */
 export function projectShareCheckedAnalysis(loaded) {
     const { automatic: _automatic, ...evidence } = loaded;
-    const automatic = projectAutomaticStudyAnalysisView(loaded.automatic);
+    const automatic = projectAutomaticAnalysisView(loaded.automatic);
     const safe = automatic === undefined ? evidence : { ...evidence, automatic };
-    return studyAnalysisSharingProblems(safe).sensitive
+    return analysisSharingProblems(safe).sensitive
         ? {
             state: "invalid",
             analysis: null,

package/dist/analysis/store-executions.d.ts

@@ -2,15 +2,15 @@ import { type PreparedRunArtifactPaths } from "../run/paths.js";
 import { type AnalysisExecutionReceipt, type AnalysisExecutionStart } from "./validation.js";
 import type { AnalysisArtifact } from "./types.js";
 /** Exact bounded receipt lookup for an already claimed execution, never a dispatch decision. */
-export declare function readStudyAnalysisExecution(prepared: PreparedRunArtifactPaths, id: string): Promise<AnalysisExecutionReceipt | null>;
+export declare function readAnalysisExecution(prepared: PreparedRunArtifactPaths, id: string): Promise<AnalysisExecutionReceipt | null>;
 /**
  * Publish accounting first. Unlike a usable report, this receipt does not claim
  * the source still matches; its digests name the exact input that was attempted.
  */
-export declare function writeStudyAnalysisExecutionReceipt(prepared: PreparedRunArtifactPaths, value: AnalysisArtifact): Promise<void>;
+export declare function writeAnalysisExecutionReceipt(prepared: PreparedRunArtifactPaths, value: AnalysisArtifact): Promise<void>;
 /** The returned closure owns one exact directory; persisted IDs never authorize overwriting it. */
-export declare function beginStudyAnalysisExecution(prepared: PreparedRunArtifactPaths, context: Omit<AnalysisExecutionStart, "schema" | "createdAt">): Promise<(value: AnalysisArtifact) => Promise<void>>;
-export declare function listStudyAnalysisExecutions(prepared: PreparedRunArtifactPaths): Promise<{
+export declare function beginAnalysisExecution(prepared: PreparedRunArtifactPaths, context: Omit<AnalysisExecutionStart, "schema" | "createdAt">): Promise<(value: AnalysisArtifact) => Promise<void>>;
+export declare function listAnalysisExecutions(prepared: PreparedRunArtifactPaths): Promise<{
     receipts: AnalysisExecutionReceipt[];
     warnings: string[];
 }>;
@@ -21,7 +21,7 @@ export interface AnalysisAccountingRecord {
     legacy: boolean;
 }
 /** Accounting is independent of source freshness and findings validation. No evidence is opened. */
-export declare function readStudyAnalysisAccountingRecords(prepared: PreparedRunArtifactPaths): Promise<{
+export declare function readAnalysisAccountingRecords(prepared: PreparedRunArtifactPaths): Promise<{
     records: AnalysisAccountingRecord[];
     warnings: string[];
 }>;