humanish 0.106.1 → 0.108.0

package/docs/contracts/schemas.md

@@ -1,12 +1,9 @@
 # Contract Schema Index
 
-Date: 2026-06-02 (current-state note updated 2026-07-14)
-
-Status: reference map for the major contracts shipped through source version
-`0.106.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
-schema constants, parsers, and validators in `src/` are authoritative. Rows
-marked "reserved" name layering intent only; no code emits or validates them
-yet. Do not emit a reserved schema.
+This page maps the shipped contracts; it does not list every command or result envelope. The
+exported types, schema constants, parsers and validators in `src/` are the source of truth. A row
+marked "reserved" names layering intent only: no code emits or validates it yet, so do not emit a
+reserved schema.
 
 ## Purpose
 
@@ -31,7 +28,7 @@ workflow without leaking private upstream truth into core.
 | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
 | Run bundle                        | `humanish.run-bundle.v1`                                                                                                                                                       | `synthetic-run-bundle`                                                              |
 | Adapter                           | `humanish.adapter.v1`                                                                                                                                                          | `synthetic-cli-adapter`                                                             |
-| Lab                               | `humanish.lab.v2`                                                                                                                                                              | `first-run`                                                                         |
+| Study file                        | `humanish.study.v3`                                                                                                                                                            | `first-run`                                                                         |
 | Persona                           | `humanish.persona.v1`                                                                                                                                                          | `synthetic-maintainer`                                                              |
 | Scenario                          | `humanish.scenario.v1`                                                                                                                                                         | `first-run-smoke`                                                                   |
 | Actor trace                       | `humanish.actor-trace.v1`                                                                                                                                                      | `synthetic-actor-trace`                                                             |
@@ -55,32 +52,72 @@ workflow without leaking private upstream truth into core.
 | Adapter score                     | `humanish.adapter-score.v1` (`RunBundle.adapterScore`; namespaced; route-specific acceptance semantics)                                                                        | see Product-Adapter Extension Seam below                                            |
 | Adapter artifact                  | `humanish.adapter-artifact.v1` (`RunBundle.adapterArtifacts[]`; namespaced; local relative proof references)                                                                   | see Product-Adapter Extension Seam below                                            |
 | Shared-world evidence             | `humanish.shared-world.v1` (additive `RunBundle.sharedWorld` + `RunBundle.attributionClass`; `topologyMode: sequential \| concurrent`)                                         | see Shared-World Evidence below                                                     |
-| Comms thread                      | `humanish.comms-thread.v1` (off-app email/SMS the app sent, captured; a `kind: log` run-dir artifact of DIGESTS only — from/to/subject/link digests + an OTP count, never raw) | see `comms` under Lab Manifest                                                      |
+| Comms thread                      | `humanish.comms-thread.v1` (off-app email/SMS the app sent, captured; a `kind: log` run-dir artifact of digests only: from/to/subject/link digests + one OTP count, never raw) | see `comms` under Study File                                                        |
 | Serve result                      | `humanish.serve-result.v1` (`src/observer/serve.ts` is authoritative)                                                                                                          | none (command result envelope; see Serve Result below)                              |
 | Serve control plane               | reserved (`/_humanish/api/*` answers `501` `HUMANISH_SERVE_CONTROL_PLANE_DISABLED` in v1)                                                                                      | none                                                                                |
 
-## Lab Manifest
-
-Schema: `humanish.lab.v2` (types in `src/lab/types.ts`, parsed by `src/lab/config.ts`). There
-is deliberately no v1 compatibility: v1 (`kind`, top-level `sims`) had zero real users and was
-deleted when labs became config.
-
-A lab is a composition over code primitives, not a hardcoded kind:
+## Study File
+
+Schema: `humanish.study.v3`. `src/lab/parse/study-v3.ts` rewrites a v3 document into the
+normalized config in `src/lab/types.ts`, which `src/lab/config.ts` parses. A `humanish.lab.v2`
+file still parses in 0.108 with one warning that names `humanish migrate`; 0.109 removes it.
+
+A study declares its route and composes code primitives; it is not a hardcoded kind. The
+top-level keys:
+
+| Key                                                               | Meaning                                                                                                                                            |
+| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `schema`, `id`, `title`, `description`                            | the document's identity                                                                                                                            |
+| `route`                                                           | required: `preview`, `computer-use`, `shared-world`, `terminal` or `scripted`                                                                      |
+| `mode`                                                            | `dry-run` (the default) or `live`                                                                                                                  |
+| `actor`                                                           | who drives it, one object: `type`, `model`, `localAgent`, `persona`, `mission`, `tasks`, `maxOutputTokens`, `reasoningEffort`, `stopWhen`, `dwell` |
+| `participants`                                                    | a count, a homogeneous `{ count, instruction }`, or a list of entries (below)                                                                      |
+| `surfaces`                                                        | scripted only: `[desktop]` or `[desktop, mobile]`                                                                                                  |
+| `caps`                                                            | the route's budget (below)                                                                                                                         |
+| `scenario`                                                        | scripted only: a committed scenario id or path                                                                                                     |
+| `subject`, `execution`, `policies`, `review`, `defaults`, `comms` | as below                                                                                                                                           |
+
+The parser reads only the declared route's keys. A key that route never reads is an error that
+names the route, such as "route: computer-use does not read scenario. Remove it.", and an
+unknown key is an error that lists the known ones; both are `HUMANISH_STUDY_INVALID`.
+
+`participants` takes the forms its route accepts:
+
+| Route          | Forms                                                                          | Default        |
+| -------------- | ------------------------------------------------------------------------------ | -------------- |
+| `preview`      | a count                                                                        | 4              |
+| `computer-use` | a count, a homogeneous object, or a list (a `local-app` subject takes no list) | 1              |
+| `shared-world` | a list of at least two entries                                                 | none: required |
+| `scripted`     | none; `surfaces` instead                                                       |                |
+| `terminal`     | none; one agent                                                                |                |
+
+`caps` keeps each route's meaning, and a route refuses the keys it does not read:
+`computer-use` and `shared-world` read `maxUsd` and `maxTotalUsd`; `terminal` reads `maxUsd`,
+`maxJobs` and `maxMinutes`; `preview` and `scripted` take no `caps`.
+
+A v2 file maps as follows: `actors[0]` is `actor`; `lanes` is the `participants` list; a
+`roster` group is an entry with `count`; `count` is the count; `count` with `laneFocus` is the
+homogeneous object; `execution.caps` (computer-use, shared-world) or `scenario.caps`
+(terminal) is `caps`; `scenario.mode` is `mode`; `scenario.ref` is `scenario`; and
+`subject.topology: shared-world` is `route: shared-world`. A key the v2 inert-field table
+marks inert for the route is not in v3.
+
+The rest of this section names keys by their v3 spelling:
 
 - `subject`: what the run acts on: `this-repo`, `clone` (owner/repo slugs,
   optional in-sandbox `serve` + env var names + `state`), `local-tree` (the
   operator's own working tree, packed on the host and provisioned in-sandbox
   in place of a clone; see below), `app-url`
   (loopback unless `policies.allowPublicTargets` declares an owned deployment),
-  `local-app` (an already-running LOCAL dev server driven IN-PROCESS via a
-  custom `CuaExecutor`, NO clone and NO E2B desktop, always loopback),
+  `local-app` (an already-running local dev server driven in-process via a
+  custom `ComputerUseExecutor`, no clone and no E2B desktop, always loopback),
   `terminal-product` (a CLI/product a real autonomous terminal agent studies
-  from PUBLIC surfaces only; see below), or `desktop-cli` (a computer-use
+  from public surfaces only; see below), or `desktop-cli` (a computer-use
   participant using a CLI in a terminal on a hosted desktop). A
   `local-app` subject pairs a computer-use actor with `execution.target: local`
   (or absent) and is library-assisted: the caller supplies
-  `RunLabOptions.inProcess.executor` + `createProvider`; with neither the engine fails
-  closed (`HUMANISH_CUA_LAB_LOCAL_APP_NO_EXECUTOR`), never a desktop attempt. See
+  `RunStudyOptions.inProcess.executor` + `createProvider`; with neither the engine fails
+  closed (`HUMANISH_COMPUTER_USE_LOCAL_APP_NO_EXECUTOR`), never a desktop attempt. See
   [`docs/architecture/state-driven-executor.md`](../architecture/state-driven-executor.md);
 - `subject.localTree` (`local-tree` subjects, computer-use route): pack/upload
   knobs for the packed working tree: `exclude[]` (extra archive excludes on
@@ -93,8 +130,8 @@ A lab is a composition over code primitives, not a hardcoded kind:
   `maxArchiveBytes` (upload size cap override; default 256 MiB). Routing requires `execution.target: e2b-desktop` and a
   computer-use actor; `subject.serve`/`env`/`state` apply exactly as they do
   on the clone route (identical install/build/start/state semantics). The
-  packed root is the lab resolution cwd; there is no path field, by design
-  (an absolute path in a lab manifest would be a machine-specific,
+  packed root is the study resolution cwd; there is no path field, by design
+  (an absolute path in a study file would be a machine-specific,
   unshareable, leak-prone artifact). Enumeration is git-aware when the root
   is a git work tree (`git ls-files --cached --others --exclude-standard`,
   honoring `.gitignore`) or a denylist-only recursive walk otherwise; an
@@ -104,101 +141,98 @@ A lab is a composition over code primitives, not a hardcoded kind:
   `src/subject/local-tree-archive.ts`)
   applies in both modes and is not overridable. The denylist matches names,
   not contents; a secret in a file it does not name packs like any other
-  file, so review the pack summary line and use `localTree.exclude`. The lab packs
-  ONCE per run and uploads the identical archive to every fan-out participant. The
+  file, so review the pack summary line and use `localTree.exclude`. The study packs
+  once per run and uploads the identical archive to every fan-out participant. The
   in-sandbox commit refresh clone subjects use is skipped: `.git` is never
   uploaded, so identity comes from the host-side archive digest instead. See
-  [`docs/goals/local-tree-subject/goal.md`](https://github.com/danielgwilson/humanish/blob/main/docs/goals/local-tree-subject/goal.md);
+  [`docs/history/goals/local-tree-subject/goal.md`](https://github.com/danielgwilson/humanish/blob/main/docs/history/goals/local-tree-subject/goal.md);
 - `subject.product` (terminal-product subjects): the product the agent studies.
-  `product.name` is a public-safe token (committed fixtures use a NEUTRAL mock
+  `product.name` is a public-safe token (committed fixtures use a neutral mock
   name); `product.publicSurfaces[]` is the list of http(s) URLs (docs, llms.txt,
-  skill manifest) that are the ONLY world the agent sees. The lab does not
-  clone/provision the product, so its provenance is recorded UNPINNED
-  (invariant 5). `serve`/`clone`/`state`/`repos`/`appUrl` are rejected on a
+  skill manifest) that are the only world the agent sees. The study does not
+  clone/provision the product, so its provenance is recorded
+  unpinned. `serve`/`clone`/`state`/`repos`/`appUrl` are rejected on a
   terminal-product subject (a field that cannot act on the route is a parse
   error, not silently dropped). See
-  [`docs/architecture/terminal-product-lane.md`](../architecture/terminal-product-lane.md);
+  [`docs/architecture/terminal-product-route.md`](../architecture/terminal-product-route.md);
 - `subject.state` (clone or local-tree subjects, computer-use route): the
   subject's state story. `state.seed[]` declares ordered, bounded
   seed/migration/fixture steps (`{ name, command, when: before-build |
 before-start | after-ready, timeoutMs }`) executed in-sandbox around the
-  serve sequence; `state.external[]` declares env var NAMES (each must also
-  appear in `subject.env`) pointing at state the lab does not control,
-  recorded as UNPINNED in provenance. Commands persist in evidence as
+  serve sequence; `state.external[]` declares env var names (each must also
+  appear in `subject.env`) pointing at state the study does not control,
+  recorded as unpinned in provenance. Commands persist in evidence as
   sha256-16 digests only, never as text;
-- `actors`: who drives it. On computer-use (including shared-world),
-  scripted-browser, and terminal-product routes, `actors[0].type` is a real
-  dispatch key resolved against the actor registry. On the synthetic route it
-  remains a descriptive label (e.g. `synthetic-persona`). The
+- `actor`: who drives it. On the computer-use, shared-world, scripted and
+  terminal routes, `actor.type` is a real dispatch key resolved against the
+  actor registry. On the preview route it remains a descriptive label (e.g.
+  `synthetic-persona`). The
   `codex-exec` descriptor's direct `runSession` member is a fail-closed
-  compatibility entry, not the live runner; the terminal-product lab route
+  compatibility entry, not the live runner; the terminal route
   owns the live sandbox, auth, cap, evidence, and cleanup lifecycle.
-  `actors[0].count` carries route-specific meanings: synthetic route participant
-  count (simCount); scripted-browser route surface roster (1 = desktop,
-  2 = desktop + mobile, default 1); computer-use **E2B** route the HOMOGENEOUS
-  fan-out participant count (N identical participants, each its own E2B desktop: separate
-  worlds, cap 16). The in-process/local-app computer-use route stays single
-  participant (no E2B to fan out);
-- `actors[0].lanes[]` (computer-use E2B route): a DIFFERENTIATED fan-out roster,
-  each `{ id?, actorType?, surface?, caseGroup?, persona?, device?,
+  A `participants` count is the preview route's participant count (simCount),
+  and on the computer-use **E2B** route the homogeneous fan-out count (N
+  identical participants, each its own E2B desktop: separate worlds, cap 16).
+  The scripted route's `surfaces` is its surface list (`[desktop]`, the default,
+  or `[desktop, mobile]`). The in-process/local-app computer-use route stays
+  single participant (no E2B to fan out);
+- a `participants` list (computer-use E2B route): a differentiated fan-out,
+  each entry `{ id?, actorType?, surface?, caseGroup?, persona?, device?,
 instruction?, target?, entry?, host?, reasoningEffort?, stopWhen?, dwell? }` becoming one independent E2B desktop (or, on the
   shared-world routes, one participant against the shared plane). `actorType`,
   `surface`, and `caseGroup` are adapter-owned public-safe labels for grouping
   simulated users; they are not core enums, and `actorType` is deliberately
-  separate from the execution dispatch key `actors[0].type`. `lanes` is XOR with
-  `count` (declare a roster OR a homogeneous count) and XOR with
-  `actors[0].laneFocus` (a roster's per-participant `instruction` is the steer);
-  `lanes[].device` is XOR with a raw `execution.desktop.resolution`. Participant ids
+  separate from the execution dispatch key `actor.type`. A list sets the count,
+  so `--count` does not apply to it, and each entry's `instruction` is the steer;
+  an entry's `device` is XOR with a raw `execution.desktop.resolution`. Participant ids
   default `lane-01`..`lane-NN` (`role-01`..`role-NN` for shared-world participants), must be unique, and name per-participant evidence paths
-  (`actors/<streamId>.json`, `screenshots/<laneId>/`). Cap 16 participants. On other
-  routes `lanes` is inert (warned), except the scripted-browser route, which rejects it. `subject.clone.fanout` is REJECTED on
-  the cua, shared-world and scripted-browser routes (declare fan-out via
-  `count`/`lanes`). No current route reads `clone.fanout`;
-- `actors[0].lanes[].target` (app-url × computer-use E2B route only): an
+  (`actors/<streamId>.json`, `screenshots/<laneId>/`). Cap 16 participants. The other
+  routes refuse a list (table above). `subject.clone.fanout` is rejected on the
+  computer-use, shared-world and scripted routes (declare fan-out with
+  `participants`). No current route reads `clone.fanout`;
+- `participants[].target` (app-url × computer-use E2B route only): an
   absolute browser URL that participant opens instead of `subject.appUrl`. This is the
-  setup-produced-target handoff for crawler/swarm labs: an adapter may start any
+  setup-produced-target handoff for crawler/swarm studies: an adapter may start any
   topology it needs, then declare exactly which target each actor should drive.
-  If any participant declares `target`, every participant in that roster must declare one.
+  If any participant declares `target`, every entry in the list must declare one.
   Public/non-loopback targets still require `policies.allowPublicTargets: true`.
   `target` is mutually exclusive with `entry`: `target` is an absolute app-url
   browser target; `entry` is a shared-world participant's same-origin path;
-- `actors[0].roster[]` (computer-use E2B route): compact authoring sugar for
-  repeated participant groups, each `{ id, count, actorType?, surface?, caseGroup?,
-persona?, device?, instruction?, target?, entry?, host?, reasoningEffort?, stopWhen?,
-dwell? }`. The parser expands it into
-  deterministic `lanes[]` before the engine runs (`viewer-01`, `viewer-02`,
-  ...), so the runtime and run bundle keep one normalized participant shape. `roster`
-  is XOR with explicit `lanes`, homogeneous `count`, and `laneFocus`;
+- a `participants` entry with `count: n` (computer-use E2B route): a group of
+  repeated participants. It needs an `id` and the parser expands it to
+  `<id>-01` … `<id>-NN`, even when n is 1, before the engine runs (`viewer-01`,
+  `viewer-02`, ...), so the runtime and run bundle keep one normalized participant
+  shape. Ids are checked for collisions after expansion;
 - `execution.concurrency` (computer-use E2B routes, including shared-world): a
-  CAP on participants in flight at once. When omitted, every participant runs
+  cap on participants in flight at once. When omitted, every participant runs
   simultaneously: independent participants resolve it from the final participant count,
-  after any `--count` override, and the parser fills `concurrency = laneCount`
-  for multi-participant shared-world labs. Total sessions and spend are identical either way; only wall-clock
+  after any `--count` override, and the parser fills `concurrency = participantCount`
+  for multi-participant shared-world studies. Total sessions and spend are identical either way; only wall-clock
   and simultaneity differ. Declaring a value below the participant count runs participants in
   waves and emits a warning saying so, because a green waved run is otherwise
-  indistinguishable from the all-live run the author meant. Shared-world labs
+  indistinguishable from the all-live run the author meant. Shared-world studies
   need at least 2 (the host and a follower are live together); `concurrency: 1`
   there is refused at parse, since the sequential turn-taking route was removed
   in 0.106.0. The env override
-  `HUMANISH_CUA_MAX_CONCURRENCY` may only LOWER the effective bound, never
-  raise concurrent paid desktops (invariant 3), and a lowering is recorded on
+  `HUMANISH_CUA_MAX_CONCURRENCY` may only lower the effective bound, never
+  raise concurrent paid desktops, and a lowering is recorded on
   the plan (`envLoweredConcurrencyFrom`). Inert (warned) on other routes.
-  `execution.timeoutMs` is the PER-PARTICIPANT session budget on this route (semantics
+  `execution.timeoutMs` is the per-participant session budget on this route (semantics
   change: it was the single-session budget pre-fan-out); there is no run-level
   wall clock. `policies.allowPublicTargets` cannot combine with N>1 against one
   implicit public `subject.appUrl` (ambiguous shared-world-ish topology); it may
-  combine with N>1 only when the roster declares explicit `lanes[].target` for
-  every participant, OR when `subject.topology: shared-world` is ALSO declared. That
-  routes N>1 against one public target to the EXTERNAL-PUBLIC shared-world plane
+  combine with N>1 only when every `participants` entry declares `target`, or when
+  the study declares `route: shared-world`. That
+  routes N>1 against one public target to the external-public shared-world plane
   (see Shared-World Evidence below), not separate worlds;
 - `subject.publicTarget: { owner, authorized: true }` (external-public shared-world
-  route ONLY): the operator's REQUIRED ownership attestation when a real PUBLIC
-  deployment (`source: app-url` + `topology: shared-world` + `allowPublicTargets` +
+  route only): the operator's required ownership attestation when a real public
+  deployment (`source: app-url` + `route: shared-world` + `allowPublicTargets` +
   `concurrency > 1`) is used directly as the shared plane. The harness neither
   provisions nor exposes the target, so it cannot attest synthetic data; the operator
-  MUST attest they own/operate it. Author-trust (unverifiable); rejected on non-app-url
-  subjects and inert (warned) on other app-url routes. `actors[0].lanes[].host: true` marks the single designated host participant there;
-- `subject.appUrl`: a loopback http(s) URL a computer-use actor drives, OR (on the
+  must attest they own/operate it. Author-trust (unverifiable); rejected on non-app-url
+  subjects and inert (warned) on other app-url routes. `participants[].host: true` marks the single designated host participant there;
+- `subject.appUrl`: a loopback http(s) URL a computer-use actor drives, or (on the
   external-public shared-world route) the non-loopback public deployment used as the
   shared plane (with `publicTarget` + `allowPublicTargets`);
 - `execution`: where it runs (`local`, `e2b-desktop`, or `e2b-terminal`), plus
@@ -210,18 +244,18 @@ dwell? }`. The parser expands it into
   computer-use and scripted-browser routes refuse it when a library caller skips
   the parser;
 - `execution.desktop.template` (e2b-desktop computer-use and clone scripted-browser routes): a custom E2B
-  desktop TEMPLATE (image) NAME or ID the run launches on, for a subject that
+  desktop template (image) name or ID the run launches on, for a subject that
   needs runtimes the stock `desktop` image lacks (e.g. node/bun/a local Postgres
   baked into an adopter-maintained image). Any non-empty string is a valid
   name/id (no allowlist); a blank/whitespace value is rejected. Threaded to the
-  SDK's `Sandbox.create(template, opts)` on EVERY desktop-creating route (the
-  single-participant and fan-out cua participants, and the shared-world subject AND every actor
+  SDK's `Sandbox.create(template, opts)` on every desktop-creating route (the
+  single-participant and fan-out cua participants, and the shared-world subject and every actor
   sandbox); when absent the call
   stays the byte-stable `Sandbox.create(opts)` default (the stock template). The
   template actually used is recorded in the run bundle as `desktopTemplate`
   (public-safe, since a template name is not a secret). Inert (warned) on every route
   that creates no desktop, incl. the in-process `local-app` cua route, so it is
-  never silently ignored (invariant 6). Custom images need the
+  never silently ignored. Custom images need the
   Desktop SDK's `xdotool` input support, `mktemp`, and the `C.UTF-8` locale:
   every typed text is written to a private 0600 file and typed with
   `LC_ALL=C.UTF-8 xdotool type --file` in one attempt. Without that locale a
@@ -238,79 +272,76 @@ dwell? }`. The parser expands it into
   when known. Inert (warned) where this route-specific browser launcher is not
   used;
 - `execution.terminal` + `execution.runtimeAuth` (terminal-product route):
-  `terminal.transport` is `exec-stream`: captured NON-interactive exec output
+  `terminal.transport` is `exec-stream`: captured non-interactive exec output
   (stdin disabled); `pty` is rejected because labeling captured exec output as
-  an interactive PTY would overstate the mechanism (invariant 6; a true duplex
-  PTY transport does not ship). `terminal.stdin` defaults to `disabled`
+  an interactive PTY would overstate the mechanism (a duplex PTY
+  transport does not ship). `terminal.stdin` defaults to `disabled`
   (`sent`/assisted input is rejected until the interventions ledger + a
   non-comparable marker exist). `runtimeAuth` (`openai-env`, the default, or `openai-egress`)
-  declares the agent's runtime-auth channel, recorded as NAMES ONLY. On a live run, the engine
+  declares the agent's runtime-auth channel, recorded as names only. On a live run, the engine
   resolves the registered terminal descriptor and requires
   `keyPlacement: in-sandbox-command-scoped` before creating a sandbox. With `openai-env`
   the key is passed only to the agent command, never to `Sandbox.create` or
   metadata; with `openai-egress` it stays in the host-side E2B header transform
   set at sandbox creation, and the agent gets a placeholder. A dry-run neither
   reads nor injects it;
-- `scenario`: `mode: dry-run` (contract evidence, no spend) or `live`.
-  `scenario.ref` is CONSUMED (and REQUIRED) on the scripted-browser route: it
-  resolves a committed scenario (`humanish/scenarios/<ref>.yaml` or a repo
-  path) whose `browser.steps` ARE what the actor executes, digest-pinned into
-  bundle provenance; on other routes `ref`/`inline` stay forward-declared
-  warnings. On the scripted route `live` gates real browser ACTUATION against
-  the declared app. Provider spend stays $0 by mechanism (no model runs);
-- `scenario.caps` (terminal-product route): `{ maxUsd, maxJobs, maxMinutes }`,
+- `mode`: `dry-run` (a synthetic bundle, no spend; the default) or `live`. On the
+  scripted route `live` gates real browser actuation against the declared app.
+  Provider spend stays $0 there by mechanism (no model runs);
+- `scenario` (scripted route, required): a committed scenario id or path
+  (`humanish/scenarios/<id>.yaml` or a repo path) whose `browser.steps` are what
+  the actor executes, digest-pinned into bundle provenance. Every other route
+  refuses it;
+- `caps` on the terminal route: `{ maxUsd, maxJobs, maxMinutes }`,
   all non-negative numbers (0 = no-spend, the default). This budget bounds the
   in-sandbox live key by mechanism: the live key is never exercised without a
   fail-closed cap in force. `maxMinutes` is the
   wall-clock kill; `maxUsd`/`maxJobs` are enforced fail-closed against the cost
-  ledger after the session (a run whose KNOWN spend exceeds the cap fails closed,
-  `HUMANISH_TERMINAL_LAB_CAPS_EXCEEDED`). Core records Codex provider spend as
+  ledger after the session (a run whose known spend exceeds the cap fails closed,
+  `HUMANISH_TERMINAL_CAPS_EXCEEDED`). Core records Codex provider spend as
   unpriced tokens, so without a cost probe no line can trip a positive `maxUsd`:
   a live run refuses `maxUsd > 0` before creating a sandbox
-  (`HUMANISH_TERMINAL_LAB_UNPRICED_CAP`) unless the caller passes a `costProbe`
+  (`HUMANISH_TERMINAL_UNPRICED_CAP`) unless the caller passes a `costProbe`
   hook. The sandbox's server-side timeout is the steps before the
   codex command (Node bootstrap, runtime version check, and product setup when
   `subject.product.install` is declared) plus `maxMinutes` plus a 5-minute
   teardown buffer; a live run refuses a `maxMinutes` that would take it past
-  E2B's one-hour limit (`HUMANISH_TERMINAL_LAB_CAPS_INVALID`). The no-spend proof is derived from that real ledger, never asserted (see
-  Terminal Cost Ledger And No-Spend Proof).
-  Inert (warned) on every other route, except that a positive
-  `scenario.caps.maxUsd` or `scenario.caps.maxTotalUsd` on a computer-use lab
-  is a parse error naming the matching `execution.caps` field, which is what
-  that route enforces;
+  E2B's one-hour limit (`HUMANISH_TERMINAL_CAPS_INVALID`). The no-spend proof is derived from that real ledger, never asserted (see
+  Terminal Cost Ledger And No-Spend Proof). `maxTotalUsd` is refused on the
+  terminal route;
 - `policies`: `redactRepos`, `redactScreenshots`, `allowPublicTargets`,
   `mediaPermission` (`prompt` | `granted`), and the
   terminal-product credential-boundary booleans `allowPrivateRepoAccess`,
   `allowProviderCredentials`, `allowPaymentCredentials`, `allowGitHubMutation`
-  (all DEFAULT FALSE, deny-by-default; only the runtime LLM key enters, and
+  (all default false, deny-by-default; only the runtime LLM key enters, and
   only command-scoped). The scripted-browser route is loopback-only and rejects
   `redactScreenshots: true` (blur unimplemented there) and
   `allowPublicTargets: true` fail-closed rather than ignoring them.
-- `comms` (#297; hosted on the clone/local-tree computer-use route and the
+- `comms` (hosted on the clone/local-tree computer-use route and the
   shared-world getHost plane, or connected to an external catch on
   app-url/operator-provided subjects): off-app
-  email the app itself sends, made a persona-driven testable surface. Lab
+  email the app itself sends, made a persona-driven testable surface. Study
   configuration rejects `comms.sms` and unknown channel names; message-bus SMS
   types do not imply a supported SMS execution route. SMTP capture is supported
   on provisioned routes with separate worlds and rejected for shared-world studies.
   `comms.email` = `{ kind: fake, injectEnv?, port?, smtp?, recipients?, linkOrigin?, external? }`.
-  `injectEnv` is the ADOPTER-NAMED env var the app reads for its email-API base
+  `injectEnv` is the adopter-named env var the app reads for its email-API base
   URL (e.g. `RESEND_API_URL`); the harness sets it to an in-sandbox catch (so it
-  is NOT declared in `subject.env`) that captures the app's sends without touching
+  is not declared in `subject.env`) that captures the app's sends without touching
   the internet. Verify the app actually reads that variable, because a run whose
   catch captured zero sends warns at teardown for exactly that. `kind` must be
   `fake`; a real inbox names a saved `comms.email.connection` instead; `port` ≤ 65534
   (the catch reserves `port+1` for the read-only inbox listener the shared-world
-  route getHost-exposes). `recipients[]` = `{ lane, address? }`: OMIT the list
+  route getHost-exposes). `recipients[]` = `{ lane, address? }`: omit the list
   and the parser fills one deterministic address per participant
-  (`<laneId>@example.test`) so every participant can do email (#351). When declared, a
-  `lane` must be one of the lab's real participant ids (roster ids, or the generated
-  `lane-01..lane-NN` under `count`). An unknown participant id is a hard parse error
+  (`<laneId>@example.test`) so every participant can do email. When declared, a
+  `lane` must be one of the study's real participant ids (list or group ids, or the
+  generated `lane-01..lane-NN` under a count). An unknown participant id is a hard parse error
   listing them, zero addressed participants is a hard error, partial coverage warns
   with the uncovered participants. Each addressed participant's actor prompt is extended with
   the full handoff: its address ("enter exactly that"), the inbox URL, and the
   wait steering ("waiting for an email is normal, not a blocker").
-  `external` (#328) switches the funnel to an ADOPTER-HOSTED catch, which is what
+  `external` switches the funnel to an adopter-hosted catch, which is what
   makes comms work on planes humanish does not provision (app-url /
   operator-provisioned): `{ catchBaseUrl, inboxBaseUrl?, authTokenEnv? }`. The
   operator runs the catch and points their own app's email-API base URL at it.
@@ -323,14 +354,19 @@ dwell? }`. The parser expands it into
   `humanish-comms-catch` marker, so a proxy answering 200 for everything cannot
   pass for a catch), the teardown drain over `GET /deliveries`, and the same
   digest-only evidence. `authTokenEnv` names an env var holding a bearer token
-  for the drain read. The NAME is recorded as evidence; the value never
-  persists. Declaring `external` on a harness-provisioned subject warns: two
+  for the drain read. The name is recorded as evidence; the value never
+  persists. A live run refuses a token shorter than 16 characters, or not
+  well-formed Unicode, before it probes the catch
+  (`HUMANISH_COMPUTER_USE_COMMS_TOKEN_INVALID`,
+  `HUMANISH_SHARED_WORLD_COMMS_TOKEN_INVALID`), as
+  `humanish comms catch --token` does, and scrubs the token and its encoded
+  forms from every comms warning. Declaring `external` on a harness-provisioned subject warns: two
   catches would exist and the app would point at humanish's own. `linkOrigin`
   is an optional operator-declared origin the app bakes into links when it
   differs from the serve origin; the harness rewrites captured links through it
   so a clicked link resolves to a reachable host. Captured mail is drained into a
-  digest-only `humanish.comms-thread.v1` artifact (from/to/subject/link DIGESTS +
-  an OTP COUNT; no raw address/link/code persists). The READABLE proof a
+  digest-only `humanish.comms-thread.v1` artifact (from/to/subject/link digests +
+  an OTP count; no raw address/link/code persists). The readable proof a
   persona saw the email is its screenshots of the inbox page. Requires `python3`
   in the subject sandbox (the stock E2B desktop template has it).
 
@@ -356,7 +392,7 @@ Adding an existing name with different settings refuses to overwrite it.
 profiles and local key presence/source, not provider authentication or delivery.
 `comms providers --json` returns `humanish.comms-providers.v1` with explicit
 setup/receiving availability. The key store accepts `humanish keys set agentmail`.
-Saving a connection neither modifies a lab nor creates a provider resource;
+Saving a connection neither modifies a study nor creates a provider resource;
 a supported study explicitly selects `comms.email: { connection: agentmail }`.
 Optional `allowedOrigins` lists exact additional HTTP(S) origins; `linkOrigin`
 participates in the existing provisioned-subject origin rewrite. Connection
@@ -374,15 +410,15 @@ acquisition and cleanup status. It contains no raw addresses, bodies, provider I
 or content digests. `run.json` embeds the final projection as `commsReceiving` and
 carries `publication.restrictions: [real-communications]`. Verification keeps the
 run local-only regardless of screenshot redaction. See the
-[receiving contract](../architecture/real-email-receiving.md).
-
-Lab backends report results in their own schemas (`humanish.run-result.v1`,
-`humanish.cua-lab-result.v2`, `humanish.scripted-lab-result.v1`,
-`humanish.terminal-lab-result.v1`,
-`humanish.concurrent-shared-world-lab-result.v1`); the evidence record stays
-`humanish.run-bundle.v1` in every case. The computer-use result bumped to v2 for
-fan-out: it carries `plan` (the pre-flight participant table: concurrency, waves,
-per-participant session budget, worst-case sandbox-minutes), `lanes[]` (ALWAYS present,
+[receiving contract](https://humanish.dev/docs/email-receiving).
+
+A study's result has one schema on every route, `humanish.study-result.v1`
+(`src/run/study-result.ts`), with `route`, `studyId` and, until 0.109, a deprecated `labId`
+holding the same value. Route-specific fields stay on their route's result. `humanish run`
+with no study, `observe`, and a refusal made before a route is picked keep
+`humanish.run-result.v1`. The evidence record stays `humanish.run-bundle.v1` in every case.
+The computer-use result carries `plan` (the pre-flight participant table: concurrency, waves,
+per-participant session budget, worst-case sandbox-minutes), `lanes[]` (always present,
 length 1 at N=1; per-participant status/session/sandbox/subject), and `laneSummary`
 (passed/skipped/harnessErrors/hollow counts). The top-level `session`/`sandbox`
 mirror the first participant and `subject.commit` is unanimity-gated across participants
@@ -391,39 +427,46 @@ the run bundle is byte-stable with the pre-fan-out output; only the result
 projection changed. A fan-out run records a `cua-lab.fanout.plan` bundle event
 (and a `cua-lab.fanout.fail-fast` event when a harness error skips queued participants);
 `ok = observer.ok ∧ every participant ok ∧ no failed adapter or declared-scorer verdict`,
-where a dry-run participant is ok as contract evidence and a live participant must pass
+where a dry-run participant is ok as synthetic and a live participant must pass
 `participantPassed` (`src/run/judge.ts`): not skipped, status `passed`, no harness
 error, engaged, and no self-reported blocker.
 
 Explicit failed-participant reruns are supported on the CUA fan-out route via
-`humanish lab run <lab> --rerun-failed-from <run-id> [--lanes lane-a,lane-b]`.
-The source run must be a live CUA fan-out bundle. humanish creates a NEW run for
+`humanish run <study> --rerun-failed-from <run-id> [--participants <ids>]`, where a
+participant id is a declared `participants` entry id, or `lane-01`, `lane-02`, … by position.
+The source run must be a live CUA fan-out bundle. humanish creates a new run for
 the selected failed/blocked/timed-out/hollow participants (or explicit participant ids), leaves
 the source verdict unchanged, and records lineage as `run.rerun` plus a
 `cua-lab.fanout.rerun` event: source run id, selected participant ids, and previous participant
 statuses/reasons. This is intentionally not automatic retry; a passing rerun is a
 nondeterminism candidate for human/product scoring, not a rewrite of the old run.
+Without `--participants`, a participant is selected when its stream's `judgedStatus` is not `passed`.
+That field is the judge's status (`judgedStatus` in `src/run/judge.ts`), so a goal_satisfied
+session that reported a blocker counts as blocked. A source bundle without `judgedStatus` falls back
+to the stream's trace status, its actor status and completion reason, and a zero-action check.
 
-Manifests are human-authored `.yaml` source under `humanish/labs/*.yaml` for
-committed public-safe labs, or ignored `.humanish/labs/*.yaml` /
-`.humanish/local/labs/*.yaml` for private local dogfood. Fields the engine does
-not yet consume are accepted but reported as warnings (`humanish lab inspect`
-shows them), so a manifest never silently claims behavior that did not run.
+Study files are human-authored `.yaml` source under `humanish/studies/*.yaml` for
+committed public-safe studies, or ignored `.humanish/studies/*.yaml` /
+`.humanish/local/studies/*.yaml` for private local dogfood. A v3 key the declared route
+does not read is an error, so a study file never silently claims behavior that did not run.
+A v2 file keeps its inert-field warnings until 0.109 (`humanish study show` shows them).
 
-Committed fixture (`humanish/labs/first-run.yaml`):
+Committed fixture (`humanish/studies/first-run.yaml`):
 
 ```yaml
-schema: humanish.lab.v2
+schema: humanish.study.v3
 id: first-run
 title: First-run synthetic Observer
-description: Public-safe starter lab that generates a synthetic run bundle and Observer without provider spend.
+description: >-
+  Writes a preview run: a synthetic run bundle and Observer for four participants. Needs no browser,
+  model or keys, and costs nothing. Run it with humanish run first-run.
+route: preview
+mode: dry-run
 subject:
   source: this-repo
-actors:
-  - type: synthetic-persona
-    count: 4
-scenario:
-  mode: dry-run
+actor:
+  type: synthetic-persona
+participants: 4
 defaults:
   open: true
 ```
@@ -452,38 +495,40 @@ Core-owned fields:
 - `artifacts`
 - `review`
 - `feedbackCandidates`
-- `lab` (optional, additive): which manifest produced the run,
-  `{ id, path?, origin? }`, where `origin` is `committed` (humanish/labs),
+- `study` (optional, additive): which study file produced the run,
+  `{ id, path?, origin? }`, where `origin` is `committed` (`humanish/studies/`, or
+  `humanish/labs/` for a v2 file),
   `ignored` (a local overlay), or `explicit` (a path the operator passed).
-  Absent on bundles written before this contract and on library callers who
-  hand a `LabConfig` directly. Such a run has no lab, and nothing guesses
-  one. Readers wanting attribution for an older bundle may fall back to
-  `inferLegacyLabId`, which reads only the historical
-  `persona.source = "lab:<id>"` convention and nothing else.
+  `lab` holds the same value until 0.109 removes it, so a 0.107 reader keeps working.
+  Both are absent on bundles written before this contract and on library callers who
+  hand a `StudyConfig` directly; such a run has no study. Readers go through
+  `studyProvenanceOf` (`src/run/study-provenance.ts`): a valid `study`, else a valid `lab`,
+  else `inferLegacyStudyId`, which reads the `persona.source` or `scenario.source`
+  convention `study:<id>`, or `lab:<id>` from runs written before 0.108, and nothing else.
 - `subject` (optional, additive): structured subject provenance,
   `{ source: clone | app-url | local-tree, repo?, commit?, archiveSha256?,
 dirty?, envNames?, state }` where `state` is `{ provenance: seeded |
 unpinned | declared-not-run | undeclared | external-public, seed?: [{ name, when,
 commandDigest, ok?, exitCode?, timedOut?, durationMs? }], externalEnvNames?
-}`. Emitted by the computer-use and shared-world backends and the clone
+}`. Emitted by the computer-use and shared-world routes and the clone
   scripted-browser route; absent on pre-existing and other bundles. `repo`/`commit` are clone-route fields; `archiveSha256`
   (64-hex sha256, the local-tree provenance pin) and `dirty` (host git
   porcelain status at pack time) are local-tree-route fields, additive under
   `humanish.run-bundle.v1`: a dirty working tree cannot be commit-pinned, so
   the archive content digest stands in for it. `commandDigest` is the
   sha256-16 of the exact seed command; command text and env values never
-  appear. `humanish verify` fails closed when a LIVE `local-tree` bundle carries
+  appear. `humanish verify` fails closed when a live `local-tree` bundle carries
   no well-formed `archiveSha256`, in addition to the existing `subject state
 provenance` check.
-- `desktopTemplate` (optional, additive): the custom E2B desktop TEMPLATE (image)
+- `desktopTemplate` (optional, additive): the custom E2B desktop template (image)
   the run's sandbox(es) launched on, from `execution.desktop.template`, so the
-  evidence shows WHICH image ran. Present only when a template was configured;
+  evidence shows which image ran. Present only when a template was configured;
   absent == the stock `desktop` template, so every pre-existing bundle is
   byte-stable. Public-safe (a template name is not a secret).
 - `attributionClass` (optional, additive): `isolated | shared-world`. Absent ==
   `isolated`, so every existing bundle is byte-stable. It is the
-  interaction-attribution axis (#164), independent of the persona-sampling
-  evidence classes. Set to `shared-world` by the shared-world backend, paired
+  interaction-attribution axis, independent of the persona-sampling
+  evidence classes. Set to `shared-world` by the shared-world route, paired
   with `sharedWorld`.
 - `sharedWorld` (optional, additive): the shared-world evidence block
   (`humanish.shared-world.v1`); see [Shared-World Evidence](#shared-world-evidence)
@@ -557,43 +602,43 @@ feedbackCandidates: []
 
 ## Shared-World Evidence
 
-The shared-world topology (#164) is the DECLARED override of the `per-lane-worlds`
-default: N distinct actor ROLES drive ONE provisioned, mutable service plane (one
-app + one seeded DB) so their actions interact through shared state. The ONE
+The shared-world topology is the declared override of the `per-lane-worlds`
+default: N distinct participants drive one provisioned, mutable service plane (one
+app + one seeded DB) so their actions interact through shared state. The one
 subject plane is provisioned via `subject.source: clone` (a fresh `git clone`) or
 `subject.source: local-tree` (the operator's own working tree, packed on the host
 and provisioned in-sandbox in place of a clone - see `subject.localTree` above);
 both sources are accepted on the shared-world route.
 
-Current runs write only the CONCURRENT shape below. The SEQUENTIAL shape came from the
+Current runs write only the concurrent shape below. The sequential shape came from the
 sequential shared-world route, which 0.106.0 removed. Only bundles written before
 0.106.0 carry it, and `humanish verify` still checks them
-(`tests/run/legacy-sequential-shared-world.test.ts`). The SEQUENTIAL rules below apply
+(`tests/run/legacy-sequential-shared-world.test.ts`). The sequential rules below apply
 to those bundles.
 
-A shared-world bundle adds TWO additive, optional fields to `humanish.run-bundle.v1`
+A shared-world bundle adds two additive, optional fields to `humanish.run-bundle.v1`
 (absent on every other bundle, so they stay byte-stable):
 
 - `attributionClass: isolated | shared-world`: a separate attribution axis
-  ("how well did the run attribute INTERACTION?"), distinct from the persona-sampling
+  ("how well did the run attribute interaction?"), distinct from the persona-sampling
   evidence classes ("how representative is the actor?"). Absent == `isolated`.
-- `sharedWorld` (`humanish.shared-world.v1`): TWO variants discriminated by
+- `sharedWorld` (`humanish.shared-world.v1`): two variants discriminated by
   `topologyMode: "sequential" | "concurrent"` (`sharedWorldEvidenceFindings` in `src/verify/shared-world.ts` branches on
-  it FIRST; unknown/missing or a mismatched shape fails closed). Common fields:
+  it first; unknown/missing or a mismatched shape fails closed). Common fields:
   - `topology: shared-world`
   - `topologyMode: sequential | concurrent`
-  - `roleCount`: the DECLARED number of participants.
-  - `plane: { commit?, seedDigest, envNames, hostDigest?, exposure?, publicOriginDigest?, declaredOriginDigest? }`: the ONE
+  - `roleCount`: the declared number of participants.
+  - `plane: { commit?, seedDigest, envNames, hostDigest?, exposure?, publicOriginDigest?, declaredOriginDigest? }`: the one
     shared-plane provenance. `seedDigest` is the sha256-16 of the ordered seed-step
-    command digests (the seed RECIPE identity, not the runtime state); `envNames` are
-    NAMES only. `hostDigest`/`exposure` are CONCURRENT provisioned-getHost-only, and
-    `publicOriginDigest` is CONCURRENT external-public-only (below).
+    command digests (the seed recipe identity, not the runtime state); `envNames` are
+    names only. `hostDigest`/`exposure` are concurrent provisioned-getHost-only, and
+    `publicOriginDigest` is concurrent external-public-only (below).
   - `planeClass?: provisioned-getHost | external-public` and `lobbyConvergenceDigest?` are
-    CONCURRENT-only (below); both absent on the sequential shape.
+    concurrent-only (below); both absent on the sequential shape.
   - `attributionLimits: [...]`: the verify-enforced attribution ceiling (the set
     differs per `topologyMode`, below).
 
-  SEQUENTIAL shape (`topologyMode: sequential`, #164 PR1; only in bundles written before
+  Sequential shape (`topologyMode: sequential`; only in bundles written before
   0.106.0):
   - `sequence: [roleId, …]`: the role ids that actually took a turn, in declared order.
   - `skippedTail` (optional, live sequential only): `{ afterRoleId, roles,
@@ -603,128 +648,128 @@ cause, maxTotalUsd?, estimatedTotalUsd? }`. Each ordered `roles` entry names
     predecessor must have a matching `harness_error`, explicit `session_error`,
     `usage_unreported`, or measured `study_spend_limit`. Only the last cause
     carries budget figures, using the same per-participant estimates as the
-    tracker. Blocked participants need matching simulation, stream and blocked-event
-    evidence, with no actor, trace, screenshot or invented timeline turn.
+    tracker. Blocked participants need a matching `simulations[]` entry, stream and
+    blocked-event evidence, with no actor, trace, screenshot or invented timeline turn.
     Historical bundles without this field still require every role in the timeline.
   - `timeline: (checkpoint | turn)[]`: a harness-clocked, strictly alternating
     timeline that starts `cp-baseline`, alternates checkpoint → turn → checkpoint,
     and ends on a checkpoint:
     - checkpoint = `{ kind: checkpoint, name, digest, deltaFromPrev }`; `digest` is
-      sha256-16(scrub+redact(probe stdout)); the record is DIGEST-ONLY (no
+      sha256-16(scrub+redact(probe stdout)); the record is digest-only (no
       value-shaped field). `deltaFromPrev` is true when the observed state changed
       across the intervening turn.
     - turn = `{ kind: turn, roleId, simId, streamId, commit?, seedDigest }` references
       a real `RunBundle["simulations"][number]` and `RunBundle["streams"][number]`; carries the
       plane provenance it observed
       (identical across turns by construction; this is the single-plane proof).
-  - Sequential `attributionLimits` MUST contain `sequential-only`, `no-concurrent-races`,
+  - Sequential `attributionLimits` must contain `sequential-only`, `no-concurrent-races`,
     and `delta-attributed-to-turn-not-action`.
 
-  CONCURRENT shape (`topologyMode: concurrent`, #164 phase 2: N personas drive ONE
-  getHost-exposed plane AT ONCE; NO `timeline`/`sequence`):
-  - `plane.hostDigest`: sha256-16 of the harness-minted `getHost` ORIGIN every actor
-    drove (a first-class provisioned-subject target; invariant 2). A DIGEST, not the raw
+  Concurrent shape (`topologyMode: concurrent`: N personas drive one
+  getHost-exposed plane at once; no `timeline`/`sequence`):
+  - `plane.hostDigest`: sha256-16 of the harness-minted `getHost` origin every actor
+    drove (a first-class provisioned-subject target). A digest, not the raw
     URL: a getHost URL embeds the live sandbox id and matches the publish-safety e2b-URL
     redaction, so it never lands raw in a published bundle (the raw tokenless URL is
-    surfaced only on the ephemeral lab result). The orchestrator confirms the URL is
-    TOKENLESS (no authKey; invariant 1) before digesting.
-  - `plane.exposure: synthetic`: the REQUIRED author attestation that the subject behind
+    surfaced only on the ephemeral study result). The orchestrator confirms the URL is
+    tokenless (no authKey) before digesting.
+  - `plane.exposure: synthetic`: the required author attestation that the subject behind
     the internet-reachable getHost URL is synthetic seeded data (author-trust + a
-    provenance gate, NOT a no-real-data guarantee).
+    provenance gate, not a no-real-data guarantee).
   - `laneWindows: [{ roleId, simId, streamId, startedAt, endedAt, verdict, routeHostDigest,
-commit?, seedDigest }]`: one harness-clocked window per actor; OVERLAPPING windows
+commit?, seedDigest }]`: one harness-clocked window per actor; overlapping windows
     prove ≥2 personas were active simultaneously. `routeHostDigest` == `plane.hostDigest`
     (every actor drove exactly the harness-minted host).
   - `stateSeries: [{ timestamp, digest }]`: cadence digests of the shared world under
-    load (baseline + periodic + final). DIGEST-ONLY: the allowed-keys tripwire permits
-    ONLY `timestamp` + `digest` (no per-delta→actor field, because causation under concurrency
+    load (baseline + periodic + final). Digest-only: the allowed-keys tripwire permits
+    only `timestamp` + `digest` (no per-delta→actor field, because causation under concurrency
     is structurally inexpressible).
   - `outcomes: [{ roleId, simId, streamId, status, completionReason?, ok }]`: per-persona
-    OUTCOME (the "M of N succeeded" headline).
-  - Concurrent `attributionLimits` MUST contain `concurrent`,
+    outcome (the "M of N succeeded" headline).
+  - Concurrent `attributionLimits` must contain `concurrent`,
     `best-effort-causal-attribution`, `non-deterministic-shared-state`,
     `window-and-snapshot-granularity`, `contention-observed-not-proven-safe`,
-    `state-change-not-isolated-to-actors`, and MUST NOT contain `sequential-only` or
+    `state-change-not-isolated-to-actors`, and must not contain `sequential-only` or
     `no-concurrent-races` (a sequential guarantee on a concurrent run is an overclaim).
 
 The `shared-world evidence` check in `humanish verify` is fail-closed (live runs only;
-dry-run contract bundles are skipped). It dispatches on `topologyMode` FIRST.
-SEQUENTIAL: the timeline must be well-formed (start `cp-baseline`, strictly alternate,
+dry-run contract bundles are skipped). It dispatches on `topologyMode` first.
+Sequential: the timeline must be well-formed (start `cp-baseline`, strictly alternate,
 end on a checkpoint, turn order == sequence, sequence length == roleCount == turn
 count, no `laneWindows`); every turn's simId/streamId resolves; every checkpoint digest
-is sha256-16 with NO value-shaped field; all turns share ONE plane provenance; the
-mandatory limits are present; and a PASSED run shows ≥1 checkpoint `deltaFromPrev` (the
-delta-on-pass gate). CONCURRENT: no `timeline`; laneWindows and outcomes each
-cover exactly roleCount and stateSeries is present; the required limits are present AND the forbidden ones absent;
-`plane.hostDigest` present and every `routeHostDigest` equals it (invariant 2);
-`plane.exposure == synthetic` AND `subject.state.provenance == seeded` (the
+is sha256-16 with no value-shaped field; all turns share one plane provenance; the
+mandatory limits are present; and a passed run shows ≥1 checkpoint `deltaFromPrev` (the
+delta-on-pass gate). Concurrent: no `timeline`; laneWindows and outcomes each
+cover exactly roleCount and stateSeries is present; the required limits are present and the forbidden ones absent;
+`plane.hostDigest` present and every `routeHostDigest` equals it;
+`plane.exposure == synthetic` and `subject.state.provenance == seeded` (the
 synthetic-subject gate); stateSeries snapshots are digest-only (allowed-keys tripwire);
-all laneWindows share ONE plane provenance; and the CONCURRENCY-ON-PASS gate: a PASSED
-run MUST show ≥2 overlapping laneWindows AND a stateSeries delta whose timestamp is
+all laneWindows share one plane provenance; and the concurrency-on-pass gate: a passed
+run must show ≥2 overlapping laneWindows and a stateSeries delta whose timestamp is
 AT/AFTER an overlap interval start (otherwise it was not actually concurrent, or the
-world never changed under load). The per-role no-engagement guard applies to both.
-Checkpoints / stateSeries persist digest-only by DEFAULT until the #108 PII/PHI
-detector lands.
-
-WHAT THE BUNDLE CAN / CANNOT CLAIM. SEQUENTIAL: each role's own behavior at full
-fidelity; the OBSERVED system outcome as an ordered DIGEST sequence; and the
-SEQUENCED-INTERACTION proof (role B entered a world already containing role A's mutation;
-the checkpoint after A strictly precedes B's turn). It CANNOT claim action-granular
-causation, concurrency/races (sequential-only), or exact-state determinism. CONCURRENT:
-each persona's own behavior at full fidelity; per-persona OUTCOME against the contended
-world ("M of N"); PROVEN CONCURRENCY (overlapping windows); and system-state evolution
-under load (the stateSeries) with best-effort temporal correlation. It CANNOT claim
+world never changed under load). The per-participant no-engagement guard applies to both.
+Checkpoints / stateSeries persist digest-only by default until the
+[PII/PHI detector](https://github.com/danielgwilson/humanish/issues/108) lands.
+
+What the bundle can / cannot claim. Sequential: each role's own behavior at full
+fidelity; the observed system outcome as an ordered digest sequence; and the
+sequenced-interaction proof (role B entered a world already containing role A's mutation;
+the checkpoint after A strictly precedes B's turn). It cannot claim action-granular
+causation, concurrency/races (sequential-only), or exact-state determinism. Concurrent:
+each persona's own behavior at full fidelity; per-persona outcome against the contended
+world ("M of N"); proven concurrency (overlapping windows); and system-state evolution
+under load (the stateSeries) with best-effort temporal correlation. It cannot claim
 strict causal attribution of a delta to an actor (concurrent ⇒ ambiguous), determinism
-of exact state, per-action granularity, or concurrency-SAFETY (races are OBSERVED, never
-PROVEN absent). HONESTY: the deterministic $0 gate proves the plumbing + the
+of exact state, per-action granularity, or concurrency-safety (races are observed, never
+proven absent). Limits: the deterministic $0 gate proves the plumbing + the
 attribution contract. A kept 2026-06-17 live receipt separately proves one
 bounded three-persona trial against a synthetic plane. Neither the deterministic
 gate nor that receipt proves scale, repeatability, or adopter-harness replacement.
 
-### Concurrent plane classes: provisioned-getHost vs external-public (#164 phase 2, 0.20.0)
+### Concurrent plane classes: provisioned and external-public
 
-The CONCURRENT shape carries a PLANE-class discriminator, `sharedWorld.planeClass:
+The concurrent shape carries a plane-class discriminator, `sharedWorld.planeClass:
 "provisioned-getHost" | "external-public"`. Absent == `provisioned-getHost` (every existing
-concurrent bundle byte-stable). It gates EVERY getHost-specific verify assertion, so a getHost
+concurrent bundle byte-stable). It gates every getHost-specific verify assertion, so a getHost
 claim can never leak onto the external-public class (or vice versa).
 
 - `provisioned-getHost`: the historical plane described above: a `clone`/`local-tree` subject the
-  harness serves + getHost-exposes in-sandbox. The harness MINTED the host, so it asserts the
+  harness serves + getHost-exposes in-sandbox. The harness minted the host, so it asserts the
   synthetic-seeded attestation (`plane.exposure: synthetic` + `subject.state.provenance == seeded`),
   the harness-minted host identity (`plane.hostDigest`, every `routeHostDigest == it`), and an
   authoritative in-sandbox checkpoint `stateSeries` with a delta-on-pass.
 
-- `external-public`: a real, operator-OWNED public deployment used DIRECTLY as the shared plane
-  (`subject.source: app-url` + `topology: shared-world` + `policies.allowPublicTargets: true` +
-  `execution.concurrency > 1`). NO getHost, NO clone, NO subject sandbox, NO seed. The subject
+- `external-public`: a real, operator-owned public deployment used directly as the shared plane
+  (`subject.source: app-url` + `route: shared-world` + `policies.allowPublicTargets: true` +
+  `execution.concurrency > 1`). No getHost, no clone, no subject sandbox, no seed. The subject
   carries the ownership attestation `subject.publicTarget: { owner, authorized: true }` (the
-  analog of `exposure: synthetic`: you cannot attest synthetic on a real site, but you MUST attest
+  analog of `exposure: synthetic`: you cannot attest synthetic on a real site, but you must attest
   you own/operate it; author-trust, unverifiable by the harness). Evidence deltas, all
   asserted-absent (never silently dropped):
-  - `plane.publicOriginDigest`: sha256-16 of the one OBSERVED origin the participants converged on. Every
-    `laneWindow.routeHostDigest` (computed from that participant's CDP-OBSERVED final-URL origin) equals it.
+  - `plane.publicOriginDigest`: sha256-16 of the one observed origin the participants converged on. Every
+    `laneWindow.routeHostDigest` (computed from that participant's CDP-observed final-URL origin) equals it.
     `plane.declaredOriginDigest` records the operator-declared origin as evidence only; a redirect
-    can make the two differ. This proves inter-participant CONVERGENCE on one origin, NOT harness control of the plane
-    (WEAKER than getHost's `hostDigest`, and disclosed).
-  - `plane.exposure` is ABSENT (verify fails closed if `synthetic` appears, since that
+    can make the two differ. This proves inter-participant convergence on one origin, not harness control of the plane
+    (weaker than getHost's `hostDigest`, and disclosed).
+  - `plane.exposure` is absent (verify fails closed if `synthetic` appears, since that
     attestation would be false on a real site);
-    `plane.hostDigest` is ABSENT (the harness minted no host).
+    `plane.hostDigest` is absent (the harness minted no host).
   - `subject.state.provenance == "external-public"` (never `seeded`, `unpinned` or `undeclared`).
-  - `stateSeries` is OMITTED (Option A): no in-sandbox filesystem to authoritatively digest, so there
-    is NO authoritative shared-state proof. Concurrency-on-pass is RELAXED to temporal co-occupancy
-    ONLY (≥2 overlapping `laneWindows`); there is no state-delta requirement.
-  - `lobbyConvergenceDigest` (optional, strong, cheap): sha256-16 of the shared `/lobby/CODE` PATH
-    all participants' CDP URLs converged on; present only when every participant converged on ONE code. Digest-only
+  - `stateSeries` is omitted (Option A): no in-sandbox filesystem to authoritatively digest, so there
+    is no authoritative shared-state proof. Concurrency-on-pass is relaxed to temporal co-occupancy
+    only (≥2 overlapping `laneWindows`); there is no state-delta requirement.
+  - `lobbyConvergenceDigest` (optional, strong, cheap): sha256-16 of the shared `/lobby/CODE` path
+    all participants' CDP URLs converged on; present only when every participant converged on one code. Digest-only
     (the raw 6-char code and full URLs are runtime-only and never land).
-  - `attributionLimits` MUST contain the concurrent family PLUS `external-public-plane`,
+  - `attributionLimits` must contain the concurrent family plus `external-public-plane`,
     `operator-attested-target-not-harness-controlled`, `no-synthetic-attestation`,
-    `no-authoritative-shared-state-proof`, `concurrency-by-temporal-co-occupancy-only`; and MUST NOT
+    `no-authoritative-shared-state-proof`, `concurrency-by-temporal-co-occupancy-only`; and must not
     contain `sequential-only`, `no-concurrent-races`, or any `seeded`/`synthetic` limit.
 
-The getHost synthetic gate is deliberately NOT reachable from the app-url branch, and why: that gate
-exists because getHost is internet-reachable AND harness-owned (real data behind a harness-exposed
+The getHost synthetic gate is deliberately not reachable from the app-url branch, and why: that gate
+exists because getHost is internet-reachable and harness-owned (real data behind a harness-exposed
 URL is the hazard). A public site the harness neither provisioned nor exposed has neither property,
-so the gate's hazard does not exist there. Attribution stays `shared-world` (N participants, ONE plane); the
+so the gate's hazard does not exist there. Attribution stays `shared-world` (N participants, one plane); the
 plane-control claim degrades from "harness-controlled" to "operator-attested, observed-only".
 
 ## Adapter
@@ -819,7 +864,7 @@ Legacy profiles retain medium defaults. `none_declared`/`none` access needs are
 omitted. `keyboard_first` allows pointer fallback; `keyboard_only` does not.
 These are prompt instructions, not evidence that a participant complied.
 
-`humanish lab inspect` adds `personas: [{ id, resolved, brief? }]`. A brief contains
+`humanish study show` adds `personas: [{ id, resolved, brief? }]`. A brief contains
 `compilerVersion`, persona-section `text`, its pre-redaction `digest`, `redacted`,
 and an optional source-file `sourceDigest`. It excludes task criteria and runtime
 grants. This is authored context; whether a selected actor consumes it depends on
@@ -848,7 +893,7 @@ Actors execute or simulate the trial. Actor evidence is the provider-neutral
 computer-use cycles, scripted browser steps, and in-sandbox terminal-agent exec
 output all map onto one `ActorTrace`. Registered actors live in
 `src/actors/registry.ts` (`codex-app-server`, `openai-computer-use`,
-`local-agent`, `scripted-browser`, `codex-exec`). A lab that names
+`local-agent`, `scripted-browser`, `codex-exec`). A study that names
 `pi-agent-core` or `claude-agent-sdk` fails to parse. There is no
 `humanish.actor.v1`; that name never shipped.
 
@@ -860,7 +905,7 @@ Core-owned fields:
   `terminal-exec`)
 - `lane` (`code` | `computer-use` | `scripted-browser` | `terminal`)
 - `persona` (`id`, `traitsApplied`, `promptDigest`)
-- `capabilities.keyPlacement` (`external` | `in-sandbox-command-scoped`): WHERE
+- `capabilities.keyPlacement` (`external` | `in-sandbox-command-scoped`): where
   the actor's runtime key lives. It is registry metadata the engine enforces. The
   terminal agent declares `in-sandbox-command-scoped` (the agent-under-test runs
   inside the sandbox); every other actor is `external` (absent === external).
@@ -871,7 +916,7 @@ Core-owned fields:
   meaning the subject failed the script while the harness executed faithfully; and
   `budget_reached`: a computer-use session ended by a limit. The loop
   (`src/actors/computer-use/loop/ending.ts`) emits it when the time budget runs
-  out after at least one material action, when `execution.caps.maxUsd` or the
+  out after at least one material action, when `caps.maxUsd` or the
   study's shared spend threshold is crossed, when the adapter reports a local
   admission limit, or when the provider hits its output or context token limit.
   Every `budget_reached` session has status `incomplete`
@@ -883,24 +928,24 @@ Core-owned fields:
   may carry `cacheWriteInput` (tokens billed at the provider's cache-write rate,
   OpenAI 5.6+) and `turns[]` (per provider-request usage, the recorded fact
   long-context tier pricing needs). Both are additive and absent on
-  producers that do not report them (#334). Items may
+  producers that do not report them. Items may
   carry `at` (ISO-8601 recording stamp from the loop's clock) and, on
-  click-like `ui_action` items, structured `coord` (`x`/`y`). Both are additive
-  (#441): absent on older bundles and non-stamping producers, and absence means
+  click-like `ui_action` items, structured `coord` (`x`/`y`). Both are additive:
+  absent on older bundles and non-stamping producers, and absence means
   "timing/position unrecorded", never zero
-- optional `modelSettings` (`humanish.model-settings.v1`, #497): HOW the model was
+- optional `modelSettings` (`humanish.model-settings.v1`): how the model was
   asked to run, alongside `ids.model` which says which model it was.
-  `reasoningEffort` records the value the request ACTUALLY carried,
-  including the provider default when a lab declared nothing. The resolved
+  `reasoningEffort` records the value the request actually carried,
+  including the provider default when a study declared nothing. The resolved
   value is what produced the trace, and recording "unset" would misdescribe
   the run. Absent when a provider declares no settings and on every
   pre-existing bundle; tolerated by verify. It exists because effort was
-  unreachable from a lab, which made every run take the default silently. Effort
-  is part of WHO the participant was rather than of how the instrument was tuned
+  unreachable from a study, which made every run take the default silently. Effort
+  is part of who the participant was rather than of how the instrument was tuned
   (docs/principles/actor-fidelity.md), so a trace without it is a result missing
   half its sample description
 - optional `modelSettings.maxOutputTokens`: the declared positive integer
-  `actors[0].maxOutputTokens`, passed to every first-party OpenAI CUA response
+  `actor.maxOutputTokens`, passed to every first-party OpenAI CUA response
   request, including reasoning output. Absent when undeclared. The first request
   of a session and closing reports use `min(maxOutputTokens, 1024)`, or 1024 when
   undeclared; the first request also carries the opening screenshot as an
@@ -913,17 +958,37 @@ Core-owned fields:
   “provider reply cut off by the output limit; asking again” notice. A second
   cut-off reply to the same request ends the session with
   `stopCause: provider_output_limit`.
-- optional `affordanceUse` (`humanish.affordance-use.v1`): which KIND of route this
+- optional `conversation`: how the first-party OpenAI computer-use provider
+  carried the conversation between requests. `mode` is `threaded` (the server
+  kept it through `previous_response_id`) or `explicit_context` (the server kept
+  none). `explicitReason` says why: `configured` (`zeroDataRetention`) or
+  `zdr_rejection` (the organization rejected server-side state; `switchedAt` and
+  `switchedAtRequest` say when). In `explicit_context` each request carries the
+  conversation from the client, with `store: false` and the reasoning returned
+  in encrypted form. It carries the opening message, every exchange of a reply
+  with the outputs that answered it, and the latest reply. Past an estimated
+  64,000 input tokens the opening screenshot is dropped first, then the oldest
+  exchanges become lines of a note, sent as an assistant message, that keeps
+  their reasoning summaries, messages and actions as text. The two newest
+  exchanges are always carried whole, even when they alone pass the budget. `summarizedTurns` counts the earlier exchanges the latest
+  `explicit_context` request no longer carried whole: lines of the note, or
+  only counted once the note reached its cap.
+  `requests[]` has one entry per participant request: its `mode` and, in
+  `explicit_context`, `carriedExchanges`, `carriedScreenshots` and
+  `estimatedInputTokens`. Billed input per request is in `tokenUsage.turns`. A
+  participant that ran in `explicit_context` gets a run warning. Absent on other
+  providers and on earlier bundles
+- optional `affordanceUse` (`humanish.affordance-use.v1`): which kind of route this
   actor took (see Affordance Use below)
 - optional `estimatedCost` (`humanish.actor-estimated-cost.v1`): a token-derived
-  cost ESTIMATE for this participant (see Run Cost Summary And Estimated Actor Cost).
-  It is deliberately a DIFFERENT field from `tokenUsage.costUsd`: a bare
-  `costUsd` is RESERVED for a real provider-returned charge, while
-  `estimatedCost.estimatedCostUsd` is a rate-table multiply, named honestly as
-  an estimate so a reader can never confuse the two (invariant 6). Absent on
+  cost estimate for this participant (see Run Cost Summary And Estimated Actor Cost).
+  It is deliberately a different field from `tokenUsage.costUsd`: a bare
+  `costUsd` is reserved for a real provider-returned charge, while
+  `estimatedCost.estimatedCostUsd` is a rate-table multiply, named as an
+  estimate so a reader can never confuse the two. Absent on
   the Codex app-server and scripted routes and on every pre-existing bundle; the
   terminal route records a `null` estimate. A `null`
-  `estimatedCostUsd` is DECLARED ABSENT (unknown rate / no usage), never 0.
+  `estimatedCostUsd` is declared absent (unknown rate / no usage), never 0.
 
 Unexpected actor-loop diagnostics live inside `items[]` as
 `kind: notice`, `status: error` rows. They are public-safe evidence, not crash
@@ -966,12 +1031,12 @@ items: []
 
 Reserved: `humanish.substrate.v1` is named here for layering intent but has
 never shipped; no code emits or validates it. Substrate truth today lives
-inside run bundles (per-stream transport and status) and lab execution config
+inside run bundles (per-stream transport and status) and study execution config
 (`execution.target: local | e2b-desktop | e2b-terminal`). Do not emit this schema.
 
 ## Serve Result And Reserved Control-Plane Namespace
 
-`humanish serve` reports `humanish.serve-result.v1`. The exported `ServeResult`
+`humanish observe --all` reports `humanish.serve-result.v1`. The exported `ServeResult`
 type and `SERVE_SCHEMA` constant in `src/observer/serve.ts` are authoritative:
 mode (`loopback | exposed | share-safe-open`), the loopback host/port,
 `publicUrl`, the `tunnel` provider/url, an `oauth` echo (`provider`,
@@ -1012,10 +1077,10 @@ discipline** that distinguishes three states and never conflates them:
 - `usd: null` is **not measured**: no spend signal exists for the category on
   this run. `null` is written explicitly (never `undefined`-omitted, never guessed
   to `0`). A line with `null` says "this category exists but we did not measure
-  it"; the no-spend proof reports it as unmeasured and does NOT claim it is zero.
+  it"; the no-spend proof reports it as unmeasured and does not claim it is zero.
 - an **absent** line is **not applicable** (n/a) to the participant or run.
 
-`knownTotalUsd` sums ONLY the non-null lines (a `null` line contributes nothing
+`knownTotalUsd` sums only the non-null lines (a `null` line contributes nothing
 and is never coerced to `0`); `fullyMeasured` is true only when no line is null.
 Core meters only the `provider` line, populated from the actor trace's
 `tokenUsage.costUsd` when present (else `null`); `product`/`media`/`payment`
@@ -1024,7 +1089,7 @@ cost-probe seam. The terminal route records the model as `codex` and does not pi
 model, so a measured token count stays `usd: null` with `source: unpriced-token-usage`, and
 `knownTotalUsd: 0` with `fullyMeasured: false` means no line of this ledger was priced. E2B
 time for the terminal sandbox is not a line of this ledger, whose lines are checked against
-`scenario.caps.maxUsd`. The run bundle's `cost` summary prices it as a `desktop-minutes`
+`caps.maxUsd`. The run bundle's `cost` summary prices it as a `desktop-minutes`
 line (see Run Cost Summary And Estimated Actor Cost below).
 
 ```yaml
@@ -1039,10 +1104,10 @@ knownTotalUsd: 0
 fullyMeasured: false
 ```
 
-The no-spend proof (`humanish.terminal-no-spend-proof.v1`) is DERIVED from the
+The no-spend proof (`humanish.terminal-no-spend-proof.v1`) is derived from the
 ledger. It vouches only for what it measured: `knownZeroLines` (proven zero),
 `knownNonZeroLines` (break `satisfied`), and `unmeasuredLines` (the `null` lines
-it explicitly CANNOT vouch for). `satisfied` is true only when every KNOWN line
+it explicitly cannot vouch for). `satisfied` is true only when every known line
 is within `maxUsd` (for a no-spend run, `maxUsd: 0` ⇒ every known line is `0`).
 Unmeasured lines never break it, so a ledger whose lines are all `null` is
 `satisfied` with nothing proven. The `statement` says which case applies: it
@@ -1062,9 +1127,9 @@ knownTotalUsd: 0
 statement: "No-spend proof not established for maxUsd=0: no spend line was measured. …"
 ```
 
-**Full caps enforcement (fail-closed, not advisory).** `scenario.caps.maxUsd`
-is enforced against the ledger: if the observed KNOWN spend exceeds `maxUsd`, the
-run fails closed (`HUMANISH_TERMINAL_LAB_CAPS_EXCEEDED`); `maxJobs` likewise when
+**Full caps enforcement (fail-closed, not advisory).** `caps.maxUsd`
+is enforced against the ledger: if the observed known spend exceeds `maxUsd`, the
+run fails closed (`HUMANISH_TERMINAL_CAPS_EXCEEDED`); `maxJobs` likewise when
 a known job count is present; `maxMinutes` is the wall-clock kill (unchanged).
 Unknowns (`null`) never trip a cap (we cannot claim a violation we did not
 measure) and never grant a green pass (they surface as unmeasured). `verifyRun`
@@ -1074,33 +1139,58 @@ proof claims zero on a `null` line, or when known spend exceeds the declared cap
 ## Run Status (identity + liveness index)
 
 `humanish.run-status.v1` is `status.json`, written inside each run directory by
-every backend at run start, refreshed on a fixed cadence while the run is
+every route at run start, refreshed on a fixed cadence while the run is
 alive, and finalized when it ends: `{ schema, runId, state: running |
-finished, mode, lab?, pid, startedAt, updatedAt, completedAt?, outcome? }`.
+finished | interrupted, mode, study?, lab?, pid, startedAt, updatedAt, completedAt?,
+signal?, outcome? }`. `lab` repeats `study` until 0.109.
 `outcome` carries the bundle's `verdict`, `participants` and `estimatedCostUsd`
 when the run finishes, then the result's `ok` and `execution: { succeeded,
-failures: [{ kind, message }] }` once the Observer has rendered. The verdict is
-what the participants experienced; `execution` is whether the run worked as an
-execution (`kind` is `harness`, `provider-cleanup`, `sandbox-cleanup`,
-`evidence`, `cap` or `run`), and `ok` reads both under the route's policy
-(`OUTCOME_POLICIES` in `src/run/judge.ts`).
-
-It answers two questions the filesystem could not answer before: **which lab**
+failures: [{ kind, message }], warnings? }` once the Observer has rendered. The
+verdict is what the participants experienced; `execution` is whether the run
+worked as an execution (`kind` is `harness`, `provider-cleanup`,
+`provider-policy`, `sandbox-cleanup`, `evidence`, `cap` or `run`), and `ok`
+reads both under the route's policy (`OUTCOME_POLICIES` in `src/run/judge.ts`).
+`provider-policy` names a computer-use or shared-world participant whose Codex
+app-server reported a disallowed item at any point in the session, or whose
+output could not be checked (a byte, frame or event limit, a malformed line, or
+a last frame cut off by anything but humanish's own signal, which is a run
+warning with its byte count). It is recorded even when a request already failed for it,
+because a step that tolerates a failed request (the debrief) would otherwise
+absorb it, and it fails the run on every route.
+`warnings`, in the same shape, holds the failures the policy lets warn and is
+omitted when empty: on computer-use, shared-world and scripted runs, a
+`sandbox-cleanup` entry for each sandbox whose release was not confirmed, with
+the participant (or `subject`), the release warning and the
+`humanish reclaim --run <id>` command. A local VM writes no receipt, so its
+entry names the container and the `docker rm --force --volumes <container>`
+command that removes it (through `limactl shell` on a Mac).
+
+`interrupted` with `signal` (`SIGINT`, `SIGTERM` or `SIGHUP`) is written by
+the CLI's run command when that signal stops a live run outside post-run
+analysis. It then kills the E2B sandboxes the run's `sandbox-receipts.ndjson`
+names, writes `reclaim-receipt.json` as `humanish reclaim` does, and exits
+128+n. The bundle is not finished: run.json keeps its last live flush, and no
+`outcome` is written. A `running` record that stopped refreshing still reads as
+interrupted once stale. A library caller of `runStudy` gets no signal handling. A
+humanish older than this field rejects the state and falls back to the bundle's
+own liveness.
+
+It answers two questions the filesystem could not answer before: **which study**
 a run belongs to, and **whether it is still alive**, including for runs an
-agent launched (`lab run --json`) or that were detached, which previously wrote
+agent launched (`run --json`) or that were detached, which previously wrote
 nothing at all until they completed.
 
-It is a DERIVED INDEX, not evidence. `run.json` remains the evidence-of-record;
+It is a derived index, not evidence. `run.json` remains the evidence-of-record;
 `verify` never gates on `status.json`, nothing in it is a claim about what a
 participant did, and when the two disagree the bundle wins and the record is
 rebuildable from it. A `running` record whose `updatedAt` is older than three
-touch intervals is INTERRUPTED, not alive. A dropped connection or a killed
+touch intervals is interrupted, not alive. A dropped connection or a killed
 terminal leaves exactly that shape, so the record reads as interrupted
 (`classifyRunStatus` is the one shared definition). Fields are
 public-safe by construction: no hostname and no user paths, because a run
 directory may be shared.
 
-## Run Index, Run Detail, And The Terminal Surface (#455)
+## Run Index, Run Detail, And The Terminal Surface
 
 Three derived projections that exist so a surface can list, classify and watch
 runs without opening evidence for all of them. None is authoritative: `run.json`
@@ -1110,17 +1200,17 @@ them is a claim about what a participant did.
 `humanish.run-index.v1` is the listing projection. One entry per run, read
 cheapest-source-first: the `status.json` record, else the bundle, else the run
 directory alone. `{ runId, derivedFrom: status | bundle | directory, liveness,
-mode?, pid?, lab?, startedAt?, updatedAt?, completedAt?, verdict?,
+mode?, pid?, study?, startedAt?, updatedAt?, completedAt?, verdict?,
 participants?, estimatedCostUsd?, durationMs? }`. The point is cost: walking
 every run tree and parsing every bundle measured 167ms on a 25-run project,
 against 16ms cold and 2.8ms warm here, which is what makes a surface that
 refreshes on a cadence affordable. `derivedFrom` is reported so a surprising row
 can be traced to the file it came from. A run with receipts and no outcome is
 `interrupted` (the shape a dropped connection leaves), and so is an
-IN-PROGRESS bundle reached without a status record: there is no freshness to
+in-progress bundle reached without a status record: there is no freshness to
 judge, and nothing in it says the run finished.
 
-`humanish.run-detail.v1` is the watching projection, for ONE run. Who is in it
+`humanish.run-detail.v1` is the watching projection, for one run. Who is in it
 and what they are thinking: `{ runId, participants: [{ id, label, personaId?,
 traits, status?, completionReason?, thought?, turns?, actions?, thoughts?,
 estimatedCostUsd? }], observerPath?, automaticAnalysis? }`. It reads the actor trace from
@@ -1128,7 +1218,7 @@ estimatedCostUsd? }], observerPath?, automaticAnalysis? }`. It reads the actor t
 finished, preferring the live one, so a single screen renders a run the whole
 way through. A reasoning item still being written is skipped rather than quoted
 half-finished, and the text is carried verbatim: a surface may wrap it, and
-nothing paraphrases it. Unlike the index this DOES open the bundle, which is affordable
+nothing paraphrases it. Unlike the index this does open the bundle, which is affordable
 only because it is asked for the one run being watched.
 
 `humanish.tui-result.v1` is what `humanish tui` emits when it refuses:
@@ -1137,23 +1227,23 @@ only because it is asked for the one run being watched.
 `HUMANISH_TUI_BUNDLE_MISSING`. `HUMANISH_TUI_AGENT_SESSION` is the one a TTY
 check could not catch: `codex exec` allocates a PTY for the commands it runs, so
 both streams are terminals and the surface used to open. A study watched an
-agent move through the labs list and start a run it did not mean to start
-(humanish/labs/handed-a-human-surface.yaml). The refusal names the environment variable
+agent move through the studies list and start a run it did not mean to start
+(humanish/studies/handed-a-human-surface.yaml). The refusal names the environment variable
 that identified the runner, so the reader can check the claim, and `--force` is
 the escape for a person who really is at that keyboard. Every other
 command is built for an agent to drive; this one takes the screen and waits for
 a person, so a non-interactive stdin or stdout fails closed naming the commands
-that DO answer the question rather than rendering escape codes into a pipe.
+that do answer the question rather than rendering escape codes into a pipe.
 
 ## Run Cost Summary And Estimated Actor Cost
 
-The computer-use (CUA) route surfaces an ADVISORY, additive cost ESTIMATE. It is
+The computer-use (CUA) route surfaces an advisory, additive cost estimate. It is
 never authoritative: every dollar figure is a rate-table multiply, labeled
-"estimated (rates as of `<date>`)", and is NEVER presented as a provider charge
-(invariant 6). Three new `.v1` schema tags ship, all additive and optional so
+"estimated (rates as of `<date>`)", and is never presented as a provider charge.
+Three new `.v1` schema tags ship, all additive and optional so
 `humanish.run-bundle.v1` stays v1 and every pre-existing bundle is byte-stable:
 
-- `humanish.pricing.v1`: the OPERATOR-EDITABLE rate table in `src/run/pricing.ts`:
+- `humanish.pricing.v1`: the operator-editable rate table in `src/run/pricing.ts`:
   dated per-model input/output USD-per-token rates and E2B CPU/GiB-second
   rates, each with a public pricing-page `source` and an `asOf`
   date. A prominent banner says these are estimates to update when providers
@@ -1163,16 +1253,18 @@ never authoritative: every dollar figure is a rate-table multiply, labeled
   request; priced exactly only from the trace's per-request `turns` ledger;
   totals alone never re-tier, which errs toward under-estimating). Some
   entries are `placeholder: true` stand-ins (the legacy desktop helper's
-  8-vCPU/8-GiB planning assumption); an operator MUST confirm them before trusting
+  8-vCPU/8-GiB planning assumption); an operator must confirm them before trusting
   the magnitude; the flag propagates into every estimate so a stand-in is never
-  mistaken for a live rate. An UNKNOWN model/desktop rate is DECLARED ABSENT
+  mistaken for a live rate. An unknown model/desktop rate is declared absent
   (`estimatedCostUsd: null` + a `reason`), never guessed.
 - `humanish.actor-estimated-cost.v1` (`ActorTrace.estimatedCost`): one participant's
   token-derived model cost, with `estimatedCostUsd` (or `null` + `reason`
   `no_rate_for_model`/`no_token_usage`/`account_billing_unknown`), `ratesAsOf`, `source`, `modelId`,
-  optional `placeholder`, and a `breakdown`.
+  optional `placeholder`, and a `breakdown`. `basis: aggregated_turns_base_rate` marks usage that
+  arrived as turn totals, such as Codex `turn.completed`, priced at the base tier because no single
+  request's size is known; the run summary's `model-tokens` line carries the same `basis`.
 - `humanish.run-cost-summary.v1` (`RunBundle.cost`): the sum of every participant's
-  `model-tokens` lines PLUS `desktop-minutes` lines. New independent CUA runs
+  `model-tokens` lines plus `desktop-minutes` lines. New independent CUA runs
   price each owned desktop separately; concurrent shared-world runs add one line per participant
   and a `laneId: subject` desktop line for a provisioned plane; older single aggregate
   lines remain readable.
@@ -1184,23 +1276,24 @@ never authoritative: every dollar figure is a rate-table multiply, labeled
   unconfirmed allocation adds `desktop_lifetime_incomplete` as a second null line.
   Live terminal-product runs emit the same summary: one `desktop-minutes` line for
   the E2B shell sandbox (its acquired-to-cleanup span and `e2b.getInfo` size) and
-  one `model-tokens` line for the Codex participant, which stays `null` with
-  `no_rate_for_model` (model `codex`) or `no_token_usage`. The terminal trace
-  records that same null `estimatedCost`. The sandbox line is not part of the
-  terminal cost ledger, whose lines are checked against `scenario.caps.maxUsd`.
-
-The summary follows the SAME null discipline as the terminal cost ledger above.
-`estimatedTotalUsd` sums ONLY the non-null `breakdown` lines and is `null` iff
-EVERY line is null (never coerced to `0`); a present-but-unpriceable line stays
+  one `model-tokens` line for the Codex participant, priced from the model the route passed
+  to Codex (`gpt-5.6-sol` unless the study declares one) with `basis:
+aggregated_turns_base_rate`, or `null` with `no_token_usage`. Older terminal bundles record
+  `no_rate_for_model` (model `codex`). The terminal trace records the same `estimatedCost`. The sandbox line is not part of the
+  terminal cost ledger, whose lines are checked against `caps.maxUsd`.
+
+The summary follows the same null discipline as the terminal cost ledger above.
+`estimatedTotalUsd` sums only the non-null `breakdown` lines and is `null` iff
+every line is null (never coerced to `0`); a present-but-unpriceable line stays
 in `breakdown` with `estimatedCostUsd: null` + a `reason` (it records that we
 tried and could not price it) and contributes nothing. `fullyEstimated` is
 `false` when any applicable line is null (the total is then a lower bound). A spend-free
 live run has no lines and records `estimatedTotalUsd: 0` with `ratesAsOf: null`; verify
 asks for a rates date only when a line is priced.
 `placeholder` is true when any contributing rate is a stand-in; `ratesAsOf` is
-the MIN (oldest) `asOf` across contributing rates. An aggregate is only as fresh
-as its stalest input, so MAX would overclaim freshness (each `breakdown` line
-keeps its own true `asOf`). `desktopMinutes` is a HOST-SIDE
+the min (oldest) `asOf` across contributing rates. An aggregate is only as fresh
+as its stalest input, so max would overclaim freshness (each `breakdown` line
+keeps its own true `asOf`). `desktopMinutes` is a host-side
 acquired-handle→cleanup span, excluding allocation/startup before handle acquisition.
 It approximates E2B's server-side billed lifetime. Plan fees, credits, and negotiated
 prices are excluded; unknown remaining lifetime makes `fullyEstimated` false.
@@ -1234,17 +1327,17 @@ desktopMinutes: 1
 note: "Estimated 11.60167 USD total…"
 ```
 
-`verifyRun` asserts LABELING/provenance, never MAGNITUDE. Absence PASSES
+`verifyRun` asserts labeling and provenance, never magnitude. Absence passes
 (fail-open on display): a bundle with no cost, a null estimate that carries a
-`reason` and a null `ratesAsOf`, or a participant without `estimatedCost` verifies fine. A CLAIMED number FAILS closed when it lacks its
+`reason` and a null `ratesAsOf`, or a participant without `estimatedCost` verifies fine. A claimed number fails closed when it lacks its
 `ratesAsOf` date or `source`, or when `estimatedTotalUsd` does not equal the
 rounded sum of its non-null lines (a null line coerced to 0 is a mechanism
 mismatch). A correctly-labeled huge estimate still passes. Cost is neither a
 secret nor a share-blocker: its magnitude never affects `shareSafety`. A labeling
 failure fails verify, which blocks sharing like any other failed check.
 
-**Computer-use spend thresholds.** `execution.caps.maxUsd` applies independently
-to each participant. `execution.caps.maxTotalUsd` shares an estimated model-spend ledger
+**Computer-use spend thresholds.** `caps.maxUsd` applies independently
+to each participant. `caps.maxTotalUsd` shares an estimated model-spend ledger
 across the study's participants. Either, both, or neither may be declared. Without a
 shared threshold, N participants each have their own `maxUsd`; N × `maxUsd` is the sum
 of those thresholds, not a guaranteed total spending ceiling.
@@ -1288,10 +1381,10 @@ threshold is not proof of task completion.
 An absent threshold is uncapped. A zero threshold can still permit a paid model
 request before reported usage trips it; `maxUsd: 0` is not a no-provider-call
 mode. Use the keyless `humanish run first-run` preview or an explicit
-`humanish lab run <lab> --dry-run` for a path without provider calls. A declared
+`humanish run <study> --dry-run` for a path without provider calls. A declared
 threshold on a model `src/run/pricing.ts` cannot price is refused at preflight
-(`HUMANISH_CUA_LAB_UNPRICED_CAP`, or `HUMANISH_CONCURRENT_SHARED_WORLD_LAB_UNPRICED_CAP` on a
-shared-world lab) before sandbox allocation. This rate-availability
+(`HUMANISH_COMPUTER_USE_UNPRICED_CAP`, or `HUMANISH_SHARED_WORLD_UNPRICED_CAP` on a
+shared-world study) before sandbox allocation. This rate-availability
 check is separate from the post-response spend check.
 
 Library callers can make a capped session stricter by composing it from the loop and the default
@@ -1321,9 +1414,9 @@ on, and any failed or stalled request stops the session; both stop with `harness
 `stopCause: usage_unreported`, and the label “provider usage unavailable.” It is not recorded as a
 crossed threshold. `singleDispatch: true` disables the OpenAI adapter's HTTP and
 policy-negotiation retries, so each turn makes at most one request.
-`runCuaActorSession({ requireReportedUsageForSpendCap: true })` sets `singleDispatch` itself and
-is deprecated in this minor. It also attaches `trace.estimatedCost` for an injected
-account-billed provider, which the composition does not. The loop cancels its owned request signal when a
+This composition replaces `runCuaActorSession`, which set `singleDispatch` itself and was removed
+in 0.107.0. Unlike `runCuaActorSession`, it attaches no `trace.estimatedCost` for an injected
+account-billed provider. The loop cancels its owned request signal when a
 request ends or its timeout wins; injected providers must honor cancellation
 and remain responsible for their own internal dispatch. Known usage remains in
 the trace alongside an explicit unknown. Reported zero input and output counts
@@ -1332,19 +1425,19 @@ original interruption cause first, with any missing usage still recorded as
 unknown.
 
 These computer-use rules do not replace the terminal route's separate
-`scenario.caps` cost-ledger and product-spend rules described above.
+`caps` cost-ledger and product-spend rules described above.
 
 ## Affordance Use
 
-`humanish.affordance-use.v1` (additive `ActorTrace.affordanceUse`) records WHICH
-KIND of route an actor took, per dispatched action, as counts by class:
+`humanish.affordance-use.v1` (additive `ActorTrace.affordanceUse`) records which
+kind of route an actor took, per dispatched action, as counts by class:
 
 | Class              | What it covers                                                                                                |
 | ------------------ | ------------------------------------------------------------------------------------------------------------- |
 | `pointer`          | click, double-click, drag, scroll: interaction with what is rendered                                          |
 | `keyboard`         | typed text and key presses into the page                                                                      |
 | `speech`           | spoken input from a `speak` action                                                                            |
-| `url-navigation`   | typing a URL (the `nav` subset); a HUMAN affordance, see below                                                |
+| `url-navigation`   | typing a URL (the `nav` subset); a human affordance, see below                                                |
 | `script-execution` | a `javascript:` or `data:` URL; not a human affordance                                                        |
 | `devtools`         | developer tooling opened by keyboard chord                                                                    |
 | `browser-internal` | `chrome://`, `about:`, `view-source:`, `devtools:`, `file:`, `edge:`, `brave:` (the browser, not the product) |
@@ -1355,45 +1448,49 @@ rate; `shortcutTotal` rolls up `script-execution` + `devtools` +
 `browser-internal`, and a value of `0` is a meaningful result rather than an
 absence.
 
-Direct URL navigation is deliberately its OWN class and is grouped with the
+Direct URL navigation is deliberately its own class and is grouped with the
 naturalistic classes, not with script execution: `load(url)` appears in 99.4% of
 2,337 real human web demonstrations, so address-bar use is ordinary human
 behavior and classifying it as a shortcut would make an ordinary human participant look
 unfaithful. See [`docs/principles/actor-fidelity.md`](../principles/actor-fidelity.md)
 for the evidence and the scoping of what a fidelity claim can mean.
 
-The record carries a CLASS and at most a scheme-shaped signal (`javascript:`,
+The record carries a class and at most a scheme-shaped signal (`javascript:`,
 `https:`, a devtools chord), never the typed text, which can be a password, a
 session token, or an identifying URL path. Classification runs at dispatch
 because the text exists only there: the trace's own action label deliberately
 renders `type [N chars]`.
 
-The harness states NO verdict about a class. Whether an affordance invalidates a
+The harness states no verdict about a class. Whether an affordance invalidates a
 study depends on the population that study declares, which is product semantics
 and belongs to the adopter's scorer. That scorer already receives the full trace,
 so `affordanceUse` needs no extra wiring to reach it. Present on computer-use participants
 that dispatched at least one action; absent elsewhere and on every pre-existing
 bundle, and its absence is tolerated by verify.
 
-## Library options (`RunLabOptions`)
-
-`runLab(config, options)` checks its options against the lab's route before anything runs. A
-refusal comes back in the route's own result envelope, with no run directory, receipt or sandbox.
-
-| Option                                   | What it does                                                                                                                                                                                                                                       | Routes                                                                                                                                                                  |
-| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `env`                                    | Keys and subject env for the run. Defaults to `process.env`                                                                                                                                                                                        | all                                                                                                                                                                     |
-| `scorer`                                 | An `AdapterScorerModule` (`score`, `deriveFeedback`, and `deriveArtifacts` on browser routes) over the finished evidence                                                                                                                           | computer use, shared world, terminal                                                                                                                                    |
-| `createProvider(ctx)`                    | The participant's brain. `ctx` is `ProviderContext`: `config`, `participant { id, index, count }` and `executor`                                                                                                                                   | computer use: E2B, local VM or in process                                                                                                                               |
-| `inProcess.executor({ config, appUrl })` | Drives an `app-url` or `local-app` subject in process, one participant. Requires `createProvider`                                                                                                                                                  | computer use                                                                                                                                                            |
-| `prepareDesktop(desktop, target)`        | Runs on an E2B sandbox before provisioning. `target` is `{ kind: "subject" }` or `{ kind: "participant", participant }`                                                                                                                            | computer use on E2B (each participant); shared world (provisioned: the subject, then each participant; external-public: each participant); scripted clone (the subject) |
-| `onEvent(event)`                         | Observes `LabEvent`s, below                                                                                                                                                                                                                        | all                                                                                                                                                                     |
-| `onStream(event)`                        | Awaited. `ready` after a participant's live stream starts; its `url` carries an auth key and must never be persisted. `ended` after the participant's sandbox is gone. A rejected `ready` becomes a run warning; an `ended` rejection is swallowed | computer use and shared world on E2B                                                                                                                                    |
-| `analysisSignal`                         | Cancels post-run analysis only                                                                                                                                                                                                                     | routes with post-run analysis                                                                                                                                           |
-| `onObserverReady(observer)`              | Awaited before any participant desktop exists                                                                                                                                                                                                      | live computer use; live shared world, where the provisioned subject sandbox is already billed                                                                           |
-| `rerun.participantIds`                   | Participants to rerun from `rerun.sourceRunId`                                                                                                                                                                                                     | computer use                                                                                                                                                            |
-
-`LabEvent` has four types:
+## Library options
+
+`runStudy(config, options)` checks its `RunStudyOptions` against the study's route before anything
+runs. A refusal comes back in the route's own result envelope, with no run directory, receipt or
+sandbox. The 0.107 names (`runLab`, `RunLabOptions`, `parseLabConfig`, `LAB_CONFIG_SCHEMA`,
+`LabConfig`, the `Lab*` result and event types, the nine `Cua*` loop types, `CuaAdmissionLimitError`
+and `BrowserLabScoringContext`) are deprecated aliases with the same value or class until 0.109
+(`src/library-aliases.ts`).
+
+| Option                                   | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Routes                                                                                                                                                                  |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `env`                                    | Keys and subject env for the run. Defaults to `process.env`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | all                                                                                                                                                                     |
+| `scorer`                                 | An `AdapterScorerModule` (`score`, `deriveFeedback`, and `deriveArtifacts` on browser routes) over the finished evidence. A scorer written for one context passes through `browserScorer` or `terminalScorer`                                                                                                                                                                                                                                                                                                                                                                                                                                              | computer use, shared world, terminal                                                                                                                                    |
+| `createProvider(ctx)`                    | The participant's brain. `ctx` is `ProviderContext`: `config`, `participant { id, index, count }` and `executor`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | computer use: E2B, local VM or in process                                                                                                                               |
+| `inProcess.executor({ config, appUrl })` | Drives an `app-url` or `local-app` subject in process, one participant. Requires `createProvider`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | computer use                                                                                                                                                            |
+| `prepareDesktop(desktop, target)`        | Runs on an E2B sandbox before provisioning. `target` is `{ kind: "subject" }` or `{ kind: "participant", participant }`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | computer use on E2B (each participant); shared world (provisioned: the subject, then each participant; external-public: each participant); scripted clone (the subject) |
+| `onEvent(event)`                         | Observes `StudyEvent`s, below                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | all                                                                                                                                                                     |
+| `onStream(event)`                        | Awaited. `ready` after a participant's live stream starts; its `url` carries an auth key and must never be persisted. `ended` after the participant's sandbox is gone. A rejected `ready` becomes a run warning; an `ended` rejection is swallowed. Each event carries `participantId`, `recordId` (the id of this participant's entry in `run.json` `simulations[]`, such as `sim-001`, which `streams[].simId` also holds) and `streamId`; `ready` adds `sandboxId` and `url`. `simId` is the older name for `recordId`: its first read prints a `DeprecationWarning` with code `HUMANISH_STREAM_EVENT_FIELD_DEPRECATED`, and the next minor removes it. | computer use and shared world on E2B                                                                                                                                    |
+| `analysisSignal`                         | Cancels post-run analysis only                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | routes with post-run analysis                                                                                                                                           |
+| `onObserverReady(observer)`              | Awaited before any participant desktop exists                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | live computer use; live shared world, where the provisioned subject sandbox is already billed                                                                           |
+| `rerun.participantIds`                   | Participants to rerun from `rerun.sourceRunId`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | computer use                                                                                                                                                            |
+
+`StudyEvent` has four types:
 
 - `plan`: the participants (`id`, `persona`, `device`, `instructionDigest`) before any sandbox
   or provider call. Computer use only; the other routes gain it later.
@@ -1408,43 +1505,61 @@ throw or a rejected promise becomes a redacted run warning.
 
 Refusals:
 
-- `HUMANISH_LAB_OPTION_UNSUPPORTED`: the route cannot honor the option, for example `scorer` on
-  a preview or scripted lab, `createProvider` off computer use, or `prepareDesktop` where no E2B
-  desktop exists. The message names the option and the route.
-- `HUMANISH_LAB_OPTION_CONFLICT`: a new option is set together with the older field it replaces.
-
-The older route hook bags (`cuaHooks`, `scriptedHooks`, `terminalHooks`, `sharedWorldHooks`) and
-`rerun.laneIds` keep their behavior in this minor and are removed in the next. Each old field in
-use emits one `DeprecationWarning` (code `HUMANISH_RUN_LAB_OPTION_DEPRECATED`) per process:
-
-| Old field                                                                                          | New home               |
-| -------------------------------------------------------------------------------------------------- | ---------------------- |
-| `score`, `deriveFeedback` on `cuaHooks`, `sharedWorldHooks` or `terminalHooks`                     | `scorer`               |
-| `deriveArtifacts` on `cuaHooks` or `sharedWorldHooks`                                              | `scorer`               |
-| `cuaHooks.buildProvider`                                                                           | `createProvider`       |
-| `cuaHooks.buildExecutor`                                                                           | `inProcess.executor`   |
-| `prepareDesktop` on `cuaHooks`, `scriptedHooks` or `sharedWorldHooks`                              | `prepareDesktop`       |
-| `cuaHooks.onPreflight`; `onPhase` on `cuaHooks` or `sharedWorldHooks`; `automaticAnalysis.onStart` | `onEvent`              |
-| `onRuntimeStreamReady`, `onRuntimeStreamEnded` on `cuaHooks` or `sharedWorldHooks`                 | `onStream`             |
-| `automaticAnalysis.deps.signal`                                                                    | `analysisSignal`       |
-| `env` on any bag                                                                                   | `env`                  |
-| `rerun.laneIds`                                                                                    | `rerun.participantIds` |
-| `cuaHooks.createDesktopLane`                                                                       | none                   |
-
-`cuaHooks.createDesktopLane` warns and goes in the next minor with no replacement: a run's desktop
-is E2B, the local VM or in process. The bags' other fields are test seams with no public
-replacement, and they do not warn. A
-`scorer` passed through `RunLabOptions` behaves exactly like the same functions in the old bag,
-including the route-specific verdict rules in the next section.
+- `HUMANISH_STUDY_OPTION_UNSUPPORTED`: the route cannot honor the option, for example `scorer` on
+  a preview or scripted study, `createProvider` off computer use, or `prepareDesktop` where no E2B
+  desktop exists. The message names the option and the route. The same code refuses a field
+  `RunStudyOptions` no longer has (below); that message names the field and where its job went.
+
+`rerun.laneIds`, the older name of `rerun.participantIds`, was removed in 0.107.0. A caller that
+still passes it is refused with `HUMANISH_STUDY_OPTION_UNSUPPORTED`; use `rerun.participantIds`.
+
+The route hook bags (`cuaHooks`, `scriptedHooks`, `terminalHooks`, `sharedWorldHooks`,
+`automaticAnalysis`) were removed from `RunStudyOptions`, with the hook bag types and the four route
+runners that took them (`runCuaActorLab`, `runScriptedBrowserLab`, `runTerminalProductLab`,
+`runConcurrentSharedWorld`). `lab` and `scorerProvenance` are set only by the humanish CLI. A
+JavaScript caller that passes any of these fields is refused before anything runs. Where each
+bag field's job went:
+
+| Removed field                                                                                      | Use                  |
+| -------------------------------------------------------------------------------------------------- | -------------------- |
+| `score`, `deriveFeedback` on `cuaHooks`, `sharedWorldHooks` or `terminalHooks`                     | `scorer`             |
+| `deriveArtifacts` on `cuaHooks` or `sharedWorldHooks`                                              | `scorer`             |
+| `cuaHooks.buildProvider`                                                                           | `createProvider`     |
+| `cuaHooks.buildExecutor`                                                                           | `inProcess.executor` |
+| `prepareDesktop` on `cuaHooks`, `scriptedHooks` or `sharedWorldHooks`                              | `prepareDesktop`     |
+| `cuaHooks.onPreflight`; `onPhase` on `cuaHooks` or `sharedWorldHooks`; `automaticAnalysis.onStart` | `onEvent`            |
+| `onRuntimeStreamReady`, `onRuntimeStreamEnded` on `cuaHooks` or `sharedWorldHooks`                 | `onStream`           |
+| `automaticAnalysis.deps.signal`                                                                    | `analysisSignal`     |
+| `env` on any bag                                                                                   | `env`                |
+| `cuaHooks.createDesktopLane`                                                                       | none                 |
+
+`cuaHooks.createDesktopLane` has no replacement: a run's desktop is E2B, the local VM or in
+process. The bags' other fields were test seams with no public replacement. `scorer` keeps the
+route-specific verdict rules in the next section.
+
+0.107.0 also removed these exports from `humanish`. A removed function no longer warns; an import
+of it fails.
+
+| Removed export                                                                                                                                 | Use                                                                                                                                                                                                                                                                                                                                            |
+| ---------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `runDryRun`, `RunOptions`, `RunResult`                                                                                                         | `runStudy(config, options)` on a `this-repo` study; its result is `StudyResult<"preview">`                                                                                                                                                                                                                                                     |
+| `runCuaActorSession`                                                                                                                           | `runComputerUseLoop` with `createOpenAiResponsesProvider({ singleDispatch: true })`, `redaction: defaultRedactionHooks` and `now: Date.now`, which `runCuaActorSession` defaulted (the composition above). A caller that passed `desktop` and `executorOptions` writes its own `ComputerUseExecutor`: the E2B desktop executor is not exported |
+| `CuaActorLabResult`, `ScriptedBrowserLabResult`, `TerminalProductLabResult`, `ConcurrentSharedWorldLabResult`                                  | `StudyResult<"computer-use">`, `StudyResult<"scripted">`, `StudyResult<"terminal">`, `StudyResult<"shared-world">`                                                                                                                                                                                                                             |
+| `SubjectPhaseEvent`                                                                                                                            | the `subject-phase` `StudyEvent` through `onEvent`. Its `type` is `"subject-phase"`; the phase that was `type` is `name`, and `target` is `{ kind: "subject" }` or `{ kind: "participant", participant }`. `message`, `at`, `ok` and `durationMs` are unchanged                                                                                |
+| `StudyOutcome.backend`, `LabBackend`                                                                                                           | `outcome.route`                                                                                                                                                                                                                                                                                                                                |
+| `selectLabBackend`, the `routesTo*` predicates, `actorResolvesToTerminal`                                                                      | `routeOf(config)`                                                                                                                                                                                                                                                                                                                              |
+| `resolveLabDryRun`                                                                                                                             | `RunStudyOptions.dryRun`; without it, `scenario.mode` decides                                                                                                                                                                                                                                                                                  |
+| `cuaLaneCount`                                                                                                                                 | the `plan` `StudyEvent`, which lists every participant                                                                                                                                                                                                                                                                                         |
+| `resolveSeatUrl`                                                                                                                               | `parseStudy`, which refuses a participant entry that is not same-origin loopback; build the URL with `new URL(entry, serveUrl)`                                                                                                                                                                                                                |
+| `cuaLaneValidationReason`, `sharedWorldValidationReason`, `concurrentSharedWorldValidationReason`, `externalPublicSharedWorldValidationReason` | `parseStudy`, which returns the same reason                                                                                                                                                                                                                                                                                                    |
+| `MAX_CUA_LANES`                                                                                                                                | none; `parseStudy` refuses a roster of more than 16 participants                                                                                                                                                                                                                                                                               |
 
 ## Product-Adapter Extension Seam
 
 The terminal-product and browser/computer-use routes let an adopter attach
-product-specific scoring + feedback as a THIN in-repo extension WITHOUT forking
-core. The seam is `RunLabOptions.scorer`, an `AdapterScorerModule`, for terminal-product,
-computer-use and shared-world runs; the CLI loads the same module with `--scorer`. The older
-`TerminalProductLabHooks`, `CuaActorLabHooks` and `SharedWorldLabHooks` fields still accept the
-same functions in this minor. This is never a built-in product scorer (the adopter's scorecard
+product-specific scoring + feedback as a thin in-repo extension without forking
+core. The seam is `RunStudyOptions.scorer`, an `AdapterScorerModule`, for terminal-product,
+computer-use and shared-world runs; the CLI loads the same module with `--scorer`. This is never a built-in product scorer (the adopter's scorecard
 lives in the adopter's repo).
 
 Three product-agnostic carriers keep core's nouns closed while letting the adapter
@@ -1460,8 +1575,8 @@ status, score, summary, data? }`. Core never reads `data`, where the adopter's
   feedback-candidate shape; product-specific concepts (public CLI/product command
   observed, hosted product success-or-blocker, feedback id/draft, media/job/asset
   ids, explicit no-media/no-provider-spend proof, defection/friction risk) are
-  recorded ONLY under `adapter: { namespace, data }`, never as core enums. Core
-  validates the SHAPE (a non-empty `namespace` + a `data` record); the keys inside
+  recorded only under `adapter: { namespace, data }`, never as core enums. Core
+  validates the shape (a non-empty `namespace` + a `data` record); the keys inside
   `data` are the adapter's.
 - **Adapter artifacts** (`humanish.adapter-artifact.v1`,
   `RunBundle.adapterArtifacts[]`). A namespaced list of local relative artifact
@@ -1507,7 +1622,7 @@ Acceptance semantics are route-specific:
 
 - Terminal-product runs keep the mission-based `review` verdict unchanged for a
   library `scorer`; the adapter score is additive. A config-declared scorer
-  (`--scorer` or the lab's `review.scorer.ref`) that returns `status: fail`,
+  (`--scorer` or the study's `review.scorer.ref`) that returns `status: fail`,
   throws, or returns a malformed score turns a pass-like verdict into `fail` and
   fails the run result.
 - Browser/computer-use runs treat `adapterScore.status: fail` as product-red:
@@ -1518,18 +1633,18 @@ Acceptance semantics are route-specific:
   evidence.
 
 The `e2b-terminal` substrate is added to `RunFeedbackCandidate.substrate` so a
-terminal-agent candidate names its substrate honestly; browser candidates use
-the existing `e2b-desktop` substrate. The routes invoke hooks over FULLY-ASSEMBLED,
+terminal-agent candidate names the substrate it ran on; browser candidates use
+the existing `e2b-desktop` substrate. The routes invoke hooks over fully-assembled,
 redacted evidence (`TerminalProductScoringContext` or
-`BrowserLabScoringContext`: `bundle`, runtime-only `runDir`, run identifiers,
-actor/backend metadata; all exported public types), scrub+redact returned
-payloads, and DROP any malformed score, candidate, or artifact reference with a
+`BrowserScoringContext`: `bundle`, runtime-only `runDir`, run identifiers,
+actor and route metadata; all exported public types), scrub+redact returned
+payloads, and drop any malformed score, candidate, or artifact reference with a
 warning so a bad extension never poisons a verifiable bundle. On the terminal
-route the context also carries `transcript`: the FULL normalized session
+route the context also carries `transcript`: the full normalized session
 transcript, source-scrubbed then shape-redacted and byte-identical to the
 persisted `terminal-transcript.txt` (the trace's `transcriptTail` is a ~2KB
 projection of it), so an adopter rubric can find command-tier evidence anywhere
-in the session rather than only in the tail window (#341). Default behavior
+in the session, including outside the tail window. Default behavior
 (no hook) is unchanged. `verifyRun` re-checks the surviving shapes fail-closed,
 including existence for referenced adapter artifacts.
 
@@ -1615,10 +1730,10 @@ bundlePath: .humanish/runs/synthetic-run-bundle-2026-06-02t10-00-00-000z-proof/r
 checks:
   - name: run.json exists
     ok: true
-    message: run.json present
+    message: run.json is present
   - name: redaction passed
     ok: true
-    message: redaction status must be passed
+    message: redaction passed
 shareSafety:
   status: share_ready
   reasons: []