humanish 0.106.1 → 0.107.0

package/dist/lab/validation.d.ts

@@ -1,8 +1,8 @@
 import type { LabConfig } from "./types.js";
 /**
- * Cross-validate the computer-use fan-out declaration (per-lane worlds). Returns the failure
- * message, or null when valid. Enforced at parse AND re-enforced in the engine (runCuaActorLab
- * is itself exported npm surface). Structural lane shape (id/device validity, id uniqueness) is
+ * Cross-validate the computer-use fan-out declaration (`per-lane-worlds`). Returns the failure
+ * message, or null when valid. Enforced at parse and re-enforced in the engine (runCuaActorLab
+ * is itself exported npm surface). Structural roster shape (id/device validity, id uniqueness) is
  * already checked in parseLanes; this is the route-scoped XOR/cap/policy layer.
  */
 export declare function cuaLaneValidationReason(config: LabConfig): string | null;
@@ -43,24 +43,24 @@ export declare function scenarioCapsValidationReason(config: LabConfig): string
 /** Refuse a claimed output bound when the route cannot pass it to the first-party provider. */
 export declare function outputTokenLimitValidationReason(config: LabConfig): string | null;
 /**
- * Cross-validate a CONCURRENT shared-world declaration (#164 phase 2). Returns the failure message,
- * or null when valid. Includes the base shared-world checks PLUS the concurrent extras: a synthetic
- * subject attestation (FIX-3), a 0.0.0.0 serve bind (FIX-4 — getHost only routes to a port bound on
- * all interfaces), and no `subject.clone.keep`/`subject.localTree.keep` (FIX-9 - either would
- * orphan actor sandboxes). Enforced at parse AND re-enforced in the engine (runConcurrentSharedWorld
+ * Cross-validate a concurrent shared-world declaration (#164 phase 2). Returns the failure message,
+ * or null when valid. Includes the base shared-world checks plus the concurrent extras: a synthetic
+ * subject attestation, a 0.0.0.0 serve bind (getHost only routes to a port bound on
+ * all interfaces), and no `subject.clone.keep`/`subject.localTree.keep` (either would
+ * orphan actor sandboxes). Enforced at parse and re-enforced in the engine (runConcurrentSharedWorld
  * is exported npm surface).
  */
 export declare function concurrentSharedWorldValidationReason(config: LabConfig): string | null;
 /**
- * Cross-validate the EXTERNAL-PUBLIC shared-world declaration (#164 phase 2): a real PUBLIC
- * deployment used DIRECTLY as the shared plane (no getHost, no clone, no subject sandbox, no seed).
- * The honest analog of concurrentSharedWorldValidationReason for a plane the harness does NOT own:
- * it FORBIDS every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
- * are inert with no sandbox — fail closed, never silently ignored, per invariant 6), and REQUIRES a
+ * Cross-validate the external-public shared-world declaration (#164 phase 2): a real public
+ * deployment used directly as the shared plane (no getHost, no clone, no subject sandbox, no seed).
+ * The counterpart of concurrentSharedWorldValidationReason for a plane the harness does not own:
+ * it rejects every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
+ * are inert with no sandbox, so they fail closed per invariant 6), and requires a
  * non-loopback appUrl + allowPublicTargets + the operator-ownership attestation subject.publicTarget +
- * concurrency >= 2 + an actors[0].lanes roster of ≥2 with EXACTLY ONE host lane. The getHost synthetic
+ * concurrency >= 2 + an actors[0].lanes roster of ≥2 with exactly one host participant. The getHost synthetic
  * gate is deliberately unreachable here (there is no internet-reachable harness-owned URL to attest).
- * Enforced at parse AND re-enforced in the engine (runConcurrentSharedWorld is exported npm surface).
+ * Enforced at parse and re-enforced in the engine (runConcurrentSharedWorld is exported npm surface).
  */
 export declare function externalPublicSharedWorldValidationReason(config: LabConfig): string | null;
 /** Analysis requires a live recording producer, including supported dry-run previews. */

package/dist/lab/validation.js

@@ -4,9 +4,9 @@ import { isHttpUrl, isLoopbackUrl } from "./parse/subject.js";
 import { declaredTargets } from "./plan-participants.js";
 import { actorResolvesToComputerUse, cuaLaneCount, MAX_CUA_LANES, registeredComputerUseActors, resolveSeatUrl, isComputerUseComposition, isScriptedBrowserComposition, isSharedWorldComposition, isTerminalProductComposition, } from "./routing.js";
 /**
- * Cross-validate the computer-use fan-out declaration (per-lane worlds). Returns the failure
- * message, or null when valid. Enforced at parse AND re-enforced in the engine (runCuaActorLab
- * is itself exported npm surface). Structural lane shape (id/device validity, id uniqueness) is
+ * Cross-validate the computer-use fan-out declaration (`per-lane-worlds`). Returns the failure
+ * message, or null when valid. Enforced at parse and re-enforced in the engine (runCuaActorLab
+ * is itself exported npm surface). Structural roster shape (id/device validity, id uniqueness) is
  * already checked in parseLanes; this is the route-scoped XOR/cap/policy layer.
  */
 export function cuaLaneValidationReason(config) {
@@ -16,8 +16,8 @@ export function cuaLaneValidationReason(config) {
     if (structuralReason) {
         return structuralReason;
     }
-    // clone.fanout is a DECLARED behavior change: rejected on the cua route (was inert-warned).
-    // Fan-out is declared via actors[0].count/lanes; subject.clone.fanout never applied here.
+    // clone.fanout is a declared behavior change: rejected on the cua route (was inert-warned).
+    // Fan-out is declared via `actors[0].count` or `actors[0].lanes`; subject.clone.fanout never applied here.
     if (config.subject.clone?.fanout !== undefined) {
         return "`subject.clone.fanout` is not used on the computer-use route: declare fan-out with actors[0].count (homogeneous) or actors[0].lanes (a roster of participants). (No current route reads clone.fanout.)";
     }
@@ -49,11 +49,11 @@ export function cuaLaneValidationReason(config) {
     if (participantCount > MAX_CUA_LANES) {
         return `Computer-use fan-out is capped at ${MAX_CUA_LANES} participants (declared ${participantCount}); N concurrent paid desktops is real spend, and there is no override above the cap this slice.`;
     }
-    // Public targets fan out into N independent worlds driving the SAME public app — that is an
-    // ambiguous shared-world-ish shape, not a per-lane target swarm. Permit N>1 public runs only when
-    // every roster lane declares its own target, making the adapter-owned topology explicit. But when
-    // `subject.topology: shared-world` is ALSO declared, N lanes against one public target is the
-    // EXTERNAL-PUBLIC shared-world topology (#164 phase 2) — ROUTE it there (a real public deployment
+    // Public targets fan out into N independent worlds driving the same public app, which is an
+    // ambiguous shared-world-ish shape, not a per-participant target swarm. Permit N>1 public runs only
+    // when every roster entry declares its own target, making the adapter-owned topology explicit. But when
+    // `subject.topology: shared-world` is also declared, N participants against one public target is the
+    // external-public shared-world topology (#164 phase 2), so route it there (a real public deployment
     // as the shared plane) instead of refusing; externalPublicSharedWorldValidationReason then applies.
     if (participantCount > 1 &&
         config.policies?.allowPublicTargets === true &&
@@ -107,9 +107,9 @@ export function sharedWorldValidationReason(config) {
         : concurrentSharedWorldValidationReason(config);
 }
 /**
- * The structural checks every provisioned shared world shares. It REQUIRES: a clone or local-tree source + e2b-desktop
+ * The structural checks every provisioned shared world shares. It requires: a clone or local-tree source + e2b-desktop
  * target + a computer-use actor + a `subject.serve` block + an `actors[0].lanes` roster of ≥2 roles (the
- * roster IS the role roster — no parallel roles[] field), and every role `entry` must resolve
+ * roster is the role roster; there is no separate roles[] field), and every role `entry` must resolve
  * same-origin (loopback) with serve.url. Fail-closed: a half-declared shared-world is rejected,
  * never silently downgraded.
  */
@@ -263,7 +263,7 @@ export function outputTokenLimitValidationReason(config) {
  * Shared-world participants share one live app, so at least two must be live at once. The
  * sequential shared-world route (`execution.concurrency: 1`) was removed in 0.106.0; the parser
  * fills an omitted concurrency with the participant count. Both callers check it after their
- * two-lane roster floor, so a one-seat roster gets the roster refusal, never this one.
+ * two-participant roster floor, so a one-seat roster gets the roster refusal, never this one.
  */
 function sharedWorldConcurrencyReason(config) {
     // Direct library callers skip the parser, so an omitted value defaults here exactly as the
@@ -275,11 +275,11 @@ function sharedWorldConcurrencyReason(config) {
     return `shared-world labs need \`execution.concurrency\` of at least 2 (got ${concurrency}). Sequential shared-world turns (concurrency 1) were removed in 0.106.0: omit execution.concurrency to run every participant at once, or set it to 2 or more. A provisioned subject also needs \`subject.exposure: synthetic\` and a \`serve.start\` that binds 0.0.0.0.`;
 }
 /**
- * Cross-validate a CONCURRENT shared-world declaration (#164 phase 2). Returns the failure message,
- * or null when valid. Includes the base shared-world checks PLUS the concurrent extras: a synthetic
- * subject attestation (FIX-3), a 0.0.0.0 serve bind (FIX-4 — getHost only routes to a port bound on
- * all interfaces), and no `subject.clone.keep`/`subject.localTree.keep` (FIX-9 - either would
- * orphan actor sandboxes). Enforced at parse AND re-enforced in the engine (runConcurrentSharedWorld
+ * Cross-validate a concurrent shared-world declaration (#164 phase 2). Returns the failure message,
+ * or null when valid. Includes the base shared-world checks plus the concurrent extras: a synthetic
+ * subject attestation, a 0.0.0.0 serve bind (getHost only routes to a port bound on
+ * all interfaces), and no `subject.clone.keep`/`subject.localTree.keep` (either would
+ * orphan actor sandboxes). Enforced at parse and re-enforced in the engine (runConcurrentSharedWorld
  * is exported npm surface).
  */
 export function concurrentSharedWorldValidationReason(config) {
@@ -304,15 +304,15 @@ export function concurrentSharedWorldValidationReason(config) {
     return null;
 }
 /**
- * Cross-validate the EXTERNAL-PUBLIC shared-world declaration (#164 phase 2): a real PUBLIC
- * deployment used DIRECTLY as the shared plane (no getHost, no clone, no subject sandbox, no seed).
- * The honest analog of concurrentSharedWorldValidationReason for a plane the harness does NOT own:
- * it FORBIDS every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
- * are inert with no sandbox — fail closed, never silently ignored, per invariant 6), and REQUIRES a
+ * Cross-validate the external-public shared-world declaration (#164 phase 2): a real public
+ * deployment used directly as the shared plane (no getHost, no clone, no subject sandbox, no seed).
+ * The counterpart of concurrentSharedWorldValidationReason for a plane the harness does not own:
+ * it rejects every provisioned-subject field (serve/state.seed/state.checkpoint/exposure/clone/repos
+ * are inert with no sandbox, so they fail closed per invariant 6), and requires a
  * non-loopback appUrl + allowPublicTargets + the operator-ownership attestation subject.publicTarget +
- * concurrency >= 2 + an actors[0].lanes roster of ≥2 with EXACTLY ONE host lane. The getHost synthetic
+ * concurrency >= 2 + an actors[0].lanes roster of ≥2 with exactly one host participant. The getHost synthetic
  * gate is deliberately unreachable here (there is no internet-reachable harness-owned URL to attest).
- * Enforced at parse AND re-enforced in the engine (runConcurrentSharedWorld is exported npm surface).
+ * Enforced at parse and re-enforced in the engine (runConcurrentSharedWorld is exported npm surface).
  */
 export function externalPublicSharedWorldValidationReason(config) {
     const structuralReason = rosterStructuralValidationReason(config);
@@ -343,13 +343,13 @@ export function externalPublicSharedWorldValidationReason(config) {
         return "the external-public shared-world route requires a non-loopback http(s) `subject.appUrl` — a loopback URL is not a shared public plane (use the getHost provisioned route for a local subject).";
     }
     // The operator-ownership attestation (the honest analog of exposure: synthetic — you cannot claim
-    // synthetic on a real site, but you MUST attest you own/operate it). Author-trust; unverifiable.
+    // synthetic on a real site, but you must attest you own/operate it). Author-trust; unverifiable.
     if (config.subject.publicTarget?.authorized !== true) {
         return "the external-public shared-world route requires `subject.publicTarget: { owner, authorized: true }` — you must attest you own/operate the public deployment used as the shared plane (author-trust; the harness cannot verify ownership).";
     }
-    // FORBID every provisioned-subject field: with no sandbox they cannot act, so they are rejected
+    // No provisioned-subject field is allowed: with no sandbox they cannot act, so they are rejected
     // with a precise reason, never silently ignored (invariant 6). exposure: synthetic in particular
-    // would be a LIE on a real site (the harness neither provisioned nor exposed it).
+    // would be a false claim on a real site (the harness neither provisioned nor exposed it).
     if (config.subject.exposure !== undefined) {
         return "`subject.exposure: synthetic` is forbidden on the external-public shared-world route — you cannot attest a real public deployment is synthetic seeded data; use `subject.publicTarget` to attest ownership instead.";
     }

package/dist/lab/warnings.js

@@ -12,13 +12,14 @@ const scriptedRoute = (routes) => !promptRoute(routes) && routes.scripted;
 const otherRoute = (routes) => !promptRoute(routes) && !routes.scripted;
 /** Rows for each actor, reported as `actors[<index>].<field>`, in this order per actor. */
 const ACTOR_ROWS = [
-    // Shared-world ONLY fields on the roster: per-role `entry` is inert anywhere else (invariant 6).
+    // Shared-world-only fields on the roster: a participant's `entry` is inert anywhere else
+    // (invariant 6).
     {
         field: "lanes[].entry",
-        reason: "the per-role loopback entry is a shared-world capability; needs subject.topology: shared-world",
+        reason: "the per-participant loopback entry is a shared-world capability; needs subject.topology: shared-world",
         applies: (actor, routes) => Boolean(rosterOf(actor)?.some((entry) => entry.entry !== undefined)) && !routes.shared,
     },
-    // The host-seat marker acts ONLY on the external-public shared-world route; inert elsewhere.
+    // The host-seat marker acts only on the external-public shared-world route; inert elsewhere.
     {
         field: "lanes[].host",
         reason: "the designated host-participant marker; needs the external-public shared-world route: app-url × topology shared-world × allowPublicTargets",
@@ -57,7 +58,7 @@ const ACTOR_ROWS = [
         reason: "the scripted-browser route fans out via actors[0].count, not an actors[0].lanes roster",
         applies: (actor, routes) => scriptedRoute(routes) && Boolean(rosterOf(actor)),
     },
-    // On every other route the prompt fields, persona and the lane roster are inert.
+    // On every other route the prompt fields, persona and the `lanes[]` roster are inert.
     { field: "mission", applies: (actor, routes) => otherRoute(routes) && Boolean(actor.mission) },
     {
         field: "laneFocus",
@@ -89,7 +90,7 @@ const CONFIG_ROWS = [
         field: "subject.state",
         applies: (config, routes) => Boolean(config.subject.state) && !routes.cua && !routes.scripted,
     },
-    // topology + checkpoint act ONLY on the shared-world route (#164); a set-but-unconsumed value
+    // topology + checkpoint act only on the shared-world route (#164); a set-but-unconsumed value
     // (incl. an explicit per-lane-worlds, which the cua route already is by mechanism) warns inert.
     {
         field: "subject.topology",
@@ -101,14 +102,14 @@ const CONFIG_ROWS = [
         reason: "the shared-world state-checkpoint probe; needs subject.topology: shared-world",
         applies: (config, routes) => config.subject.state?.checkpoint !== undefined && !routes.shared,
     },
-    // publicTarget (the external-public ownership attestation) acts ONLY on the external-public
+    // publicTarget (the external-public ownership attestation) acts only on the external-public
     // shared-world route; inert elsewhere. (It is already parse-rejected on non-app-url sources.)
     {
         field: "subject.publicTarget",
         reason: "the external-public ownership attestation; needs the external-public shared-world route: app-url × topology shared-world × allowPublicTargets",
         applies: (config, routes) => config.subject.publicTarget !== undefined && !routes.externalPublic,
     },
-    // exposure (the synthetic-subject attestation) acts ONLY on the shared-world route (the
+    // exposure (the synthetic-subject attestation) acts only on the shared-world route (the
     // getHost-exposed plane) and on scripted clones; inert elsewhere.
     {
         field: "subject.exposure",
@@ -117,7 +118,7 @@ const CONFIG_ROWS = [
             !routes.shared &&
             !(routes.scripted && config.subject.source === "clone"),
     },
-    // comms.email drives the in-sandbox email/SMS catch, which needs a subject sandbox HUMANISH
+    // comms.email drives the in-sandbox email/SMS catch, which needs a subject sandbox that humanish
     // provisions (clone or local-tree) so it holds a handle to host the catch. On an app-url /
     // operator-provided subject there is no such handle, so a declared comms block would silently
     // collect nothing — a false green. Warn at parse time (fires on inspect + dry-run too).
@@ -138,8 +139,8 @@ const CONFIG_ROWS = [
         applies: (config) => Boolean(config.comms?.email?.external) &&
             (config.subject.source === "clone" || config.subject.source === "local-tree"),
     },
-    // clone.keep IS consumed on the cua route (honored on FAILURE: the sandbox is left up to debug
-    // a failed install/boot; otherwise always killed). clone.fanout is REJECTED on the cua route
+    // clone.keep is consumed on the cua route (honored on failure: the sandbox is left up to debug
+    // a failed install/boot; otherwise always killed). clone.fanout is rejected on the cua route
     // (a hard parse error above), so it can never reach this warning list there.
     {
         field: "execution.timeoutMs",
@@ -152,13 +153,13 @@ const CONFIG_ROWS = [
         field: "execution.completionTimeoutMs",
         applies: (config) => config.execution?.completionTimeoutMs !== undefined,
     },
-    // execution.concurrency is CONSUMED on the cua route (it bounds in-flight fan-out lanes);
+    // execution.concurrency is consumed on the cua route (it bounds in-flight fan-out participants);
     // inert (warned) everywhere else.
     {
         field: "execution.concurrency",
         applies: (config, routes) => config.execution?.concurrency !== undefined && !routes.cua,
     },
-    // execution.caps is CONSUMED on the cua route (maxUsd is the fail-closed spend abort); inert
+    // execution.caps is consumed on the cua route (maxUsd is the fail-closed spend abort); inert
     // (warned) everywhere else so a misplaced budget field is never trusted to cap a route it cannot.
     {
         field: "execution.caps",
@@ -167,7 +168,7 @@ const CONFIG_ROWS = [
     },
     // terminal-product consumes subject.product, scenario.caps, execution.{terminal,runtimeAuth}:
     // dry-run records the contract; live execution enforces caps and command-scoped auth. On every
-    // OTHER route they are inert and must warn so a
+    // other route they are inert and must warn so a
     // misplaced safety/budget field is never trusted to do something it cannot (invariant 6).
     {
         field: "subject.product",
@@ -227,9 +228,9 @@ const CONFIG_ROWS = [
         field: "execution.desktop.sandboxTimeoutMs",
         applies: (config, routes) => !routes.cua && config.execution?.desktop?.sandboxTimeoutMs !== undefined,
     },
-    // execution.desktop.template (the custom E2B desktop image) is consumed ONLY where a desktop is
+    // execution.desktop.template (the custom E2B desktop image) is consumed only where a desktop is
     // actually created via Sandbox.create — the e2b-desktop computer-use routes (cua/shared-world/
-    // concurrent). It is INERT on every other route (incl. the in-process local-app cua route, which
+    // concurrent). It is inert on every other route (incl. the in-process local-app cua route, which
     // creates no desktop): warn so an unconsumed template is never silently ignored (invariant 6).
     {
         field: "execution.desktop.template",
@@ -243,7 +244,7 @@ const CONFIG_ROWS = [
         reason: "no current route reads it",
         applies: (config) => config.execution?.desktop?.codexAppServer !== undefined,
     },
-    // scenario.ref is CONSUMED on the scripted-browser route (required there); forward-declared
+    // scenario.ref is consumed on the scripted-browser route (required there); forward-declared
     // everywhere else.
     {
         field: "scenario.ref",
@@ -251,7 +252,7 @@ const CONFIG_ROWS = [
     },
     { field: "scenario.inline", applies: (config) => Boolean(config.scenario?.inline) },
     // review.{scoring,milestones,vocabulary} stay forward-declared (reserved for #319) on every route.
-    // review.scorer (#316) IS consumed (loaded + wired, or fail-closed at load) on every scorer-capable
+    // review.scorer (#316) is consumed (loaded + wired, or fail-closed at load) on every scorer-capable
     // route, so it does not warn there; on the scripted-browser route the actor carries no scorer seam,
     // so a declared scorer is flagged inert (the run also fails closed at load).
     {
@@ -297,7 +298,7 @@ function rowLabel(row, prefix = "") {
         : `${prefix}${row.field} (${row.reason})`;
 }
 // Report fields that are present but not yet consumed by the engine, so a user never trusts a
-// setting that silently does nothing. Keeps the schema forward-correct AND honest.
+// setting that silently does nothing. Keeps the schema forward-correct and honest.
 export function forwardDeclaredWarnings(config) {
     const routes = routesOf(config);
     const inert = [];
@@ -324,7 +325,7 @@ export function forwardDeclaredWarnings(config) {
             warnings.push(`execution.concurrency ${cap} caps a ${participantCount}-participant roster: participants run in waves of ${cap}, never all live at once. Remove execution.concurrency (the default runs all ${participantCount} participants simultaneously) or set it to ${participantCount}; declare a lower cap only to bound simultaneous paid desktops.`);
         }
     }
-    // Partial email coverage is legal but loud (#351): a lane without an addressed recipient never
+    // Partial email coverage is legal but loud (#351): a participant without an addressed recipient never
     // hears an inbox exists, so an email-gated flow on that seat dead-ends by construction.
     if (routes.cua && config.comms?.email?.recipients) {
         const participantIds = declaredParticipantIds(config);

package/dist/observer/artifact.d.ts

@@ -3,7 +3,7 @@ import { type ObserverData } from "./data.js";
 /**
  * Resolve — and in a repo checkout, build — the Observer artifact BEFORE any run or
  * lab work starts. A missing artifact must cost seconds at startup, never a completed
- * session (a live lane spends real money before the render step would have noticed).
+ * session (a live participant spends real money before the render step would have noticed).
  * Unconditional on purpose: the artifact is the only renderer now, so the fail-before-
  * spend property this preflight bought under the flag matters more, not less.
  */

package/dist/observer/artifact.js

@@ -5,7 +5,7 @@ import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { projectShareCheckedAnalysis, studyAnalysisSharingProblems } from "../analysis/sharing.js";
+import { projectShareCheckedAnalysis, analysisSharingProblems } from "../analysis/sharing.js";
 import { withObserverEndings } from "./data.js";
 const OBSERVER_DATA_PLACEHOLDER = "__HUMANISH_OBSERVER_DATA__";
 const OBSERVER_DATA_SLOT = `<script id="observer-data" type="application/json">${OBSERVER_DATA_PLACEHOLDER}</script>`;
@@ -13,7 +13,7 @@ let cachedObserverArtifact = null;
 /**
  * Resolve — and in a repo checkout, build — the Observer artifact BEFORE any run or
  * lab work starts. A missing artifact must cost seconds at startup, never a completed
- * session (a live lane spends real money before the render step would have noticed).
+ * session (a live participant spends real money before the render step would have noticed).
  * Unconditional on purpose: the artifact is the only renderer now, so the fail-before-
  * spend property this preflight bought under the flag matters more, not less.
  */
@@ -192,7 +192,7 @@ export function renderObserverHtml(data, options = {}) {
             },
         };
     }
-    const sharing = studyAnalysisSharingProblems(analysis);
+    const sharing = analysisSharingProblems(analysis);
     if (data.publicSafety && (sharing.sensitive || sharing.unverified)) {
         const share = data.publicSafety.share;
         data = {

package/dist/observer/data.js

@@ -1,6 +1,6 @@
 import { actorEnding } from "../actors/stop-cause.js";
 import { isCommsReceivingEvidence, receivingAnalysisContext } from "../comms/receiving-evidence.js";
-import { formatParticipantOutcomes, formatStudyTaskFunnel, participantOutcomeDetails, withCuaReviewProvenance, } from "../run/outcomes.js";
+import { formatParticipantOutcomes, formatRunTaskFunnel, participantOutcomeDetails, withCuaReviewProvenance, } from "../run/outcomes.js";
 import { cuaGoalSource, CUA_COMPLETION_NOTE } from "../actors/goal-source.js";
 export const OBSERVER_DATA_SCHEMA = "humanish.observer-data.v1";
 /** Discard a forged or stale runtime grant before projecting persisted evidence. */
@@ -95,7 +95,7 @@ export function buildObserverData(bundle, generatedAt = new Date().toISOString()
                 ? {}
                 : {
                     tasks: bundle.review.tasks,
-                    tasksLine: formatStudyTaskFunnel(bundle.review.tasks),
+                    tasksLine: formatRunTaskFunnel(bundle.review.tasks),
                 }),
         },
         summary: {

package/dist/observer/render.js

@@ -5,7 +5,7 @@ import { createServer } from "node:http";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { projectShareCheckedAnalysis } from "../analysis/sharing.js";
-import { loadStudyAnalysis } from "../analysis/load.js";
+import { loadAnalysis } from "../analysis/load.js";
 import { physicalCwdOf, runIdOf, bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveLatestRunDirectory, validatePreparedRunArtifactPaths, } from "../run/paths.js";
 import { writeContainedOutputFile } from "../run/contained-output.js";
 import { loadRunBundlePrepared } from "../run/locate.js";
@@ -87,7 +87,7 @@ export async function renderObserver(cwdInput, runInput, options = {}) {
         throw new Error("Observer output directory does not match the selected run.");
     }
     const observerPath = path.join(preparedRunPaths.physicalRunRoot, "observer", "index.html");
-    const analysis = projectShareCheckedAnalysis(await loadStudyAnalysis(preparedRunPaths));
+    const analysis = projectShareCheckedAnalysis(await loadAnalysis(preparedRunPaths));
     const observerData = buildObserverData(loaded.bundle);
     observerData.publicSafety.share = {
         status: verified.shareSafety.status,

package/dist/observer/run-routes.d.ts

@@ -4,7 +4,7 @@ import { type PinnedDirectory } from "./pinned-files.js";
 export interface ObserverRuntimeStreamUrl {
     streamId: string;
     url: string;
-    /** Set when the lane's sandbox is gone (finished or torn down). An ended stream's live URL is a
+    /** Set when the participant's sandbox is gone (finished or torn down). An ended stream's live URL is a
      *  dead noVNC page — the overlay stops injecting it so the tile falls back to the recorded
      *  evidence (keyframe replay/screenshot) instead of rendering "sandbox not found" (#357). */
     ended?: boolean;

package/dist/observer/run-routes.js

@@ -2,8 +2,8 @@
 // URLs, its analysis, and its media with byte ranges. serveObserver (render.ts) and the library
 // server (serve.ts) both route requests through them.
 import path from "node:path";
-import { isStudyAnalysisRecordPath, projectShareCheckedAnalysis } from "../analysis/sharing.js";
-import { loadStudyAnalysis } from "../analysis/load.js";
+import { isAnalysisRecordPath, projectShareCheckedAnalysis } from "../analysis/sharing.js";
+import { loadAnalysis } from "../analysis/load.js";
 import { listRuns } from "../run/stored-runs.js";
 import { bindExistingRunArtifactPaths, isPathInside, isSafeRunIdSegment } from "../run/paths.js";
 import { RUN_STATUS_FILE, RUN_STATUS_STALE_MS, isRunStatusRecord } from "../run/status.js";
@@ -23,7 +23,7 @@ async function readObserverAnalysis(runRoot) {
             prepared.runRootIdentity.ino !== runRoot.ino) {
             throw new Error("ANALYSIS_STORAGE_CHANGED");
         }
-        return projectShareCheckedAnalysis(await loadStudyAnalysis(prepared));
+        return projectShareCheckedAnalysis(await loadAnalysis(prepared));
     }
     catch {
         return {
@@ -51,7 +51,7 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
     const derivedLeaf = path.posix.basename(cleanedRelativePath);
     if (derivedRoot === ".analysis-lock" ||
         derivedLeaf.startsWith(".humanish-write-") ||
-        isStudyAnalysisRecordPath(cleanedRelativePath)) {
+        isAnalysisRecordPath(cleanedRelativePath)) {
         writeResponse(response, 404, "Not found", "text/plain; charset=utf-8");
         return;
     }
@@ -148,7 +148,7 @@ async function withLocalRunStatus(runRoot, input) {
             if (record.state === "finished") {
                 state = "finished";
             }
-            else if (now - updated <= RUN_STATUS_STALE_MS) {
+            else if (record.state === "running" && now - updated <= RUN_STATUS_STALE_MS) {
                 state = "running";
             }
         }

package/dist/observer/serve.d.ts

@@ -28,6 +28,8 @@ export interface ServeResult {
     };
     runsListed: number;
     shareReadyCount?: number;
+    /** With --safe: the runs left out, grouped by grade and reasons. */
+    hiddenRuns?: HiddenRunGroup[];
     entryRunId?: string;
     opened?: boolean;
     openCommand?: string;
@@ -46,9 +48,22 @@ interface ServeControlPlane {
         runId?: string;
     }>;
 }
+/** Why verify kept a run out of a share-safe library: its grade and reason codes. */
+interface ShareRefusal {
+    status: string;
+    reasons: string[];
+}
+/** Runs a share-safe library left out for the same grade and reasons. */
+export interface HiddenRunGroup {
+    status: string;
+    reasons: string[];
+    runs: number;
+}
 export interface ShareSafetyAdmission {
     /** The files verify found share_ready, or null when the run is not admitted. */
     admit(runId: string): Promise<AdmittedRun | null>;
+    /** Why verify refused the run, after admit returned null for it; undefined otherwise. */
+    refusal(runId: string): ShareRefusal | undefined;
 }
 export declare function createShareSafetyAdmission(cwd: string, options?: {
     verifyImpl?: typeof verifyRun;
@@ -79,6 +94,8 @@ export interface ServeLibraryServer {
     mode: ServeMode;
     runsListed: number;
     shareReadyCount?: number;
+    /** With safe: the runs left out, grouped by grade and reasons. */
+    hiddenRuns?: HiddenRunGroup[];
     entryRunId?: string;
     addPublicOrigin(origin: string): void;
     close(): Promise<void>;

package/dist/observer/serve.js

@@ -19,11 +19,17 @@ export function createShareSafetyAdmission(cwd, options = {}) {
     // content hash at read time, which drops the entry.
     const cache = new Map();
     const shareReady = (verified) => verified.ok === true && verified.shareSafety.status === "share_ready";
-    const verifyAdmission = async (runId, runDirectory, before, forget) => {
+    const verifyAdmission = async (runId, runDirectory, before, entry, forget) => {
         // A run verify refuses is never served, so its bytes are never hashed. Hashing reads every
         // byte, and one large file in a refused run would otherwise cost startup time for nothing.
-        if (!shareReady(await verifyImpl(cwd, runId)))
+        const verified = await verifyImpl(cwd, runId);
+        if (!shareReady(verified)) {
+            entry.refusal = {
+                status: verified.shareSafety.status === "share_ready" ? "blocked" : verified.shareSafety.status,
+                reasons: verified.shareSafety.reasons.map((reason) => reason.code),
+            };
             return null;
+        }
         // Admitted: hash, verify again, and hash after, so the served bytes are the ones verify scanned.
         const hashesBefore = await hashRunInventory(runDirectory, before);
         if (!hashesBefore)
@@ -62,12 +68,31 @@ export function createShareSafetyAdmission(cwd, options = {}) {
                 if (cache.get(runId) === entry)
                     cache.delete(runId);
             };
-            entry.admitted = verifyAdmission(runId, runDirectory, before, forget).catch(() => null);
+            entry.admitted = verifyAdmission(runId, runDirectory, before, entry, forget).catch(() => {
+                entry.refusal = { status: "unverifiable", reasons: ["VERIFY_FAILED"] };
+                return null;
+            });
             cache.set(runId, entry);
             return entry.admitted;
         },
+        refusal(runId) {
+            return cache.get(runId)?.refusal;
+        },
     };
 }
+/** The refused runs grouped by grade and reasons, the largest group first. */
+function hiddenRunGroups(refusals) {
+    const groups = new Map();
+    for (const refusal of refusals) {
+        const key = `${refusal.status}\0${refusal.reasons.join(",")}`;
+        const group = groups.get(key);
+        if (group)
+            group.runs += 1;
+        else
+            groups.set(key, { ...refusal, runs: 1 });
+    }
+    return [...groups.values()].sort((left, right) => right.runs - left.runs);
+}
 function sameHashes(left, right) {
     return left.size === right.size && [...left].every(([key, hash]) => right.get(key) === hash);
 }
@@ -215,10 +240,15 @@ export async function serveObserverLibrary(cwdInput, options) {
     const allRuns = (await listRuns(cwd)).runs;
     let runsListed;
     let shareReadyCount;
+    let hiddenRuns;
     if (options.safe) {
         const admitted = await Promise.all(allRuns.map((run) => admission.admit(run.runId)));
         shareReadyCount = admitted.filter((run) => run !== null).length;
         runsListed = shareReadyCount;
+        // A run refused before verify ran, such as one whose files cannot be listed, is unverifiable.
+        hiddenRuns = hiddenRunGroups(allRuns
+            .filter((_run, index) => admitted[index] === null)
+            .map((run) => admission.refusal(run.runId) ?? { status: "unverifiable", reasons: ["VERIFY_FAILED"] }));
     }
     else {
         runsListed = allRuns.length;
@@ -266,6 +296,7 @@ export async function serveObserverLibrary(cwdInput, options) {
             mode,
             runsListed,
             ...(shareReadyCount !== undefined ? { shareReadyCount } : {}),
+            ...(hiddenRuns !== undefined ? { hiddenRuns } : {}),
             ...(entryRunId ? { entryRunId } : {}),
             // A tunnel's public origin is only known after the tunnel starts (post bind); this lets the
             // caller declare it, extending the Host allowlist so the authenticated edge forwarding under

package/dist/routes/computer-use/bundle-parts.d.ts

@@ -34,7 +34,7 @@ export declare function participantFeedbackCandidates(args: {
         commsArtifactPath?: string;
     }>;
 }): RunFeedbackCandidate[];
-/** Human-readable provenance line for the single-lane subject.provenance event (invariant 5):
+/** Human-readable provenance line for the single-participant subject.provenance event (invariant 5):
  *  claims "cloned/packed and served" ONLY when it actually happened. */
 export declare function subjectProvenanceMessage(provenance: CuaSubjectProvenanceArg, publicAppUrl: string, dryRun: boolean, hasSession: boolean): string;
 export declare function providerResourcesForOutcome(args: {

package/dist/routes/computer-use/bundle-parts.js

@@ -109,7 +109,7 @@ export function participantFeedbackCandidates(args) {
     }
     return candidates;
 }
-/** Human-readable provenance line for the single-lane subject.provenance event (invariant 5):
+/** Human-readable provenance line for the single-participant subject.provenance event (invariant 5):
  *  claims "cloned/packed and served" ONLY when it actually happened. */
 export function subjectProvenanceMessage(provenance, publicAppUrl, dryRun, hasSession) {
     if (provenance.source === "clone") {
@@ -149,14 +149,21 @@ export function providerResourcesForOutcome(args) {
             kind: "sandbox",
             id: args.outcome.sandboxId,
             owner: "humanish",
-            status: args.outcome.killed ? "killed" : "running",
+            // Only a sandbox kept on purpose is known to be running; an unconfirmed release may or may
+            // not have stopped it.
+            status: args.outcome.killed
+                ? "killed"
+                : args.outcome.sandboxRelease?.state === "retained"
+                    ? "running"
+                    : "unknown",
             ...participantResourceIds(args.ids, args.participantId),
             createdAt: args.createdAt,
             cleanup: {
                 killed: args.outcome.killed,
                 reason: args.outcome.killed
                     ? "killed during normal participant teardown"
-                    : "not killed during normal participant teardown; cleanup may reclaim by exact recorded id",
+                    : (args.outcome.sandboxRelease?.warning ??
+                        "not killed during normal participant teardown; cleanup may reclaim by exact recorded id"),
             },
         },
     ];