humanish 0.110.4 → 0.111.1

package/dist/study/warnings.js

@@ -1,73 +1,54 @@
 import { isComputerUseComposition, isScriptedBrowserComposition, isSharedWorldComposition, isTerminalProductComposition, } from "./routing.js";
 import { declaredParticipantIds } from "./plan-participants.js";
 import { addressedRecipients } from "./parse/comms.js";
-import { focusOf, rosterOf } from "./parse/actors.js";
-import { actorsOf, participantList, declaredParticipantCount, scenarioRefOf, } from "./study-fields.js";
-// The computer-use and terminal routes consume mission/persona/model and laneFocus.instruction (they
-// compose the agent prompt and bundle provenance); laneFocus.id/label stay inert. On the computer-use
-// E2B route actors[0].lanes is consumed (the fan-out roster).
+import { participantList, declaredParticipantCount } from "./study-fields.js";
+// The computer-use and terminal routes consume mission/persona/model (they compose the agent prompt
+// and bundle provenance).
 const promptRoute = (routes) => routes.cua || routes.terminal;
-// The scripted-browser route consumes persona and count (trace/bundle provenance; surface roster).
-// The prompt fields can never act there: the scripted actor runs no model.
+// The scripted-browser route consumes persona and surfaces (trace/bundle provenance). The prompt
+// fields can never act there: the scripted actor runs no model.
 const scriptedRoute = (routes) => !promptRoute(routes) && routes.scripted;
 const otherRoute = (routes) => !promptRoute(routes) && !routes.scripted;
-/** Rows for each actor, reported as `actors[<index>].<field>`, in this order per actor. */
+/** Rows for the actor and its participants, reported first, in this order. */
 const ACTOR_ROWS = [
     // Shared-world-only fields on the roster: a participant's `entry` is inert anywhere else
     // (claims match mechanism).
     {
-        field: "lanes[].entry",
-        reason: "the per-participant loopback entry is a shared-world capability; needs subject.topology: shared-world",
-        applies: (actor, routes) => Boolean(rosterOf(actor)?.some((entry) => entry.entry !== undefined)) && !routes.shared,
+        field: "participants[].entry",
+        reason: "the per-participant loopback entry is a shared-world capability; needs route: shared-world",
+        applies: (config, routes) => Boolean(participantList(config)?.some((entry) => entry.entry !== undefined)) &&
+            !routes.shared,
     },
     // The host marker acts only on the external-public shared-world route; inert elsewhere.
     {
-        field: "lanes[].host",
+        field: "participants[].host",
         reason: "the designated host-participant marker; needs the external-public shared-world route: app-url × topology shared-world × allowPublicTargets",
-        applies: (actor, routes) => Boolean(rosterOf(actor)?.some((entry) => entry.host === true)) && !routes.externalPublic,
+        applies: (config, routes) => Boolean(participantList(config)?.some((entry) => entry.host === true)) &&
+            !routes.externalPublic,
     },
     {
-        field: "laneFocus.id",
-        applies: (actor, routes) => promptRoute(routes) && Boolean(focusOf(actor)?.id),
-    },
-    {
-        field: "laneFocus.label",
-        applies: (actor, routes) => promptRoute(routes) && Boolean(focusOf(actor)?.label),
-    },
-    {
-        field: "lanes",
-        reason: "only the computer-use route runs more than one participant",
-        applies: (actor, routes) => routes.terminal && Boolean(rosterOf(actor)),
-    },
-    {
-        field: "mission",
+        field: "actor.mission",
         reason: "the scripted-browser actor runs no model",
-        applies: (actor, routes) => scriptedRoute(routes) && Boolean(actor.mission),
+        applies: (config, routes) => scriptedRoute(routes) && Boolean(config.actor?.mission),
     },
     {
-        field: "laneFocus",
+        field: "actor.model",
         reason: "the scripted-browser actor runs no model",
-        applies: (actor, routes) => scriptedRoute(routes) && Boolean(focusOf(actor)),
+        applies: (config, routes) => scriptedRoute(routes) && Boolean(config.actor?.model),
     },
+    // On every other route the prompt fields and persona are inert.
     {
-        field: "model",
-        reason: "the scripted-browser actor runs no model",
-        applies: (actor, routes) => scriptedRoute(routes) && Boolean(actor.model),
+        field: "actor.mission",
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.mission),
     },
     {
-        field: "lanes",
-        reason: "the scripted-browser route fans out via actors[0].count, not an actors[0].lanes roster",
-        applies: (actor, routes) => scriptedRoute(routes) && Boolean(rosterOf(actor)),
+        field: "actor.persona",
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.persona),
     },
-    // On every other route the prompt fields, persona and the `lanes[]` roster are inert.
-    { field: "mission", applies: (actor, routes) => otherRoute(routes) && Boolean(actor.mission) },
     {
-        field: "laneFocus",
-        applies: (actor, routes) => otherRoute(routes) && Boolean(focusOf(actor)),
+        field: "actor.model",
+        applies: (config, routes) => otherRoute(routes) && Boolean(config.actor?.model),
     },
-    { field: "persona", applies: (actor, routes) => otherRoute(routes) && Boolean(actor.persona) },
-    { field: "model", applies: (actor, routes) => otherRoute(routes) && Boolean(actor.model) },
-    { field: "lanes", applies: (actor, routes) => otherRoute(routes) && Boolean(rosterOf(actor)) },
 ];
 const TERMINAL_ONLY = "needs subject.source: terminal-product + a registered terminal actor";
 const RESERVED = "reserved; no route reads it yet";
@@ -91,17 +72,10 @@ const CONFIG_ROWS = [
         field: "subject.state",
         applies: (config, routes) => Boolean(config.subject.state) && !routes.cua && !routes.scripted,
     },
-    // topology + checkpoint act only on the shared-world route; a set-but-unconsumed value
-    // (incl. an explicit per-lane-worlds, which the computer-use route already is by mechanism) warns
-    // inert.
-    {
-        field: "subject.topology",
-        reason: "drives behavior only on the shared-world route; needs subject.topology: shared-world + clone × e2b-desktop × a computer-use actor + a roster of ≥2 participants",
-        applies: (config, routes) => config.subject.topology !== undefined && !routes.shared,
-    },
+    // The checkpoint acts only on the shared-world route.
     {
         field: "subject.state.checkpoint",
-        reason: "the shared-world state-checkpoint probe; needs subject.topology: shared-world",
+        reason: "the shared-world state-checkpoint probe; needs route: shared-world",
         applies: (config, routes) => config.subject.state?.checkpoint !== undefined && !routes.shared,
     },
     // publicTarget (the external-public ownership attestation) acts only on the external-public
@@ -161,18 +135,10 @@ const CONFIG_ROWS = [
         field: "execution.concurrency",
         applies: (config, routes) => config.execution?.concurrency !== undefined && !routes.cua,
     },
-    // execution.caps is consumed on the computer-use route (maxUsd is the fail-closed spend abort);
-    // inert (warned) everywhere else so a misplaced budget field is never trusted to cap a route it
-    // cannot.
-    {
-        field: "execution.caps",
-        reason: "only the computer-use route enforces it, with a computer-use actor on e2b-desktop",
-        applies: (config, routes) => Boolean(config.execution?.caps) && !routes.cua,
-    },
-    // terminal-product consumes subject.product, scenario.caps, execution.{terminal,runtimeAuth}:
-    // dry-run records the contract; live execution enforces caps and command-scoped auth. On every
-    // other route they are inert and must warn so a
-    // misplaced safety/budget field is never trusted to do something it cannot.
+    // parse/front.ts refuses a `caps` key the declared route does not read, so no row lists `caps`.
+    // terminal-product consumes subject.product and execution.{terminal,runtimeAuth}: dry-run records
+    // the contract; live execution enforces command-scoped auth. On every other route they are inert
+    // and must warn so a misplaced safety field is never trusted to do something it cannot.
     {
         field: "subject.product",
         reason: "needs subject.source: terminal-product or desktop-cli with the matching actor",
@@ -180,18 +146,6 @@ const CONFIG_ROWS = [
             !routes.terminal &&
             config.subject.source !== "desktop-cli",
     },
-    {
-        field: "scenario.caps",
-        reason: TERMINAL_ONLY,
-        applies: (config, routes) => Boolean(config.scenario?.caps) && !routes.terminal,
-    },
-    // The study-level budget is a CUA-route capability; the terminal route is a single agent whose
-    // maxUsd already caps the whole run, so a maxTotalUsd there would be trusted and unenforced.
-    {
-        field: "scenario.caps.maxTotalUsd",
-        reason: "the study-level budget is a computer-use route capability; the terminal route's maxUsd already caps the whole run",
-        applies: (config, routes) => config.scenario?.caps?.maxTotalUsd !== undefined && routes.terminal,
-    },
     {
         field: "execution.terminal",
         reason: TERMINAL_ONLY,
@@ -247,13 +201,12 @@ const CONFIG_ROWS = [
         reason: "no current route reads it",
         applies: (config) => config.execution?.desktop?.codexAppServer !== undefined,
     },
-    // scenario.ref is consumed on the scripted-browser route (required there); forward-declared
+    // `scenario` is consumed on the scripted-browser route (required there); forward-declared
     // everywhere else.
     {
-        field: "scenario.ref",
-        applies: (config, routes) => Boolean(scenarioRefOf(config)) && !routes.scripted,
+        field: "scenario",
+        applies: (config, routes) => Boolean(config.scenario) && !routes.scripted,
     },
-    { field: "scenario.inline", applies: (config) => Boolean(config.scenario?.inline) },
     // review.{scoring,milestones,vocabulary} stay forward-declared on every route.
     // review.scorer is consumed (loaded + wired, or fail-closed at load) on every scorer-capable
     // route, so it does not warn there; on the scripted-browser route the actor carries no scorer seam,
@@ -278,7 +231,6 @@ const CONFIG_ROWS = [
         reason: "the scripted-browser actor has no adopter-scorer seam; declare it on a terminal / computer-use / shared-world route",
         applies: (config, routes) => Boolean(config.review?.scorer) && routes.scripted,
     },
-    { field: "personas", applies: (config) => Boolean(config.personas) },
 ];
 function routesOf(config) {
     const cua = isComputerUseComposition(config);
@@ -295,44 +247,35 @@ function routesOf(config) {
             config.execution?.target === "e2b-desktop",
     };
 }
-function rowLabel(row, prefix = "") {
-    return row.reason === undefined
-        ? `${prefix}${row.field}`
-        : `${prefix}${row.field} (${row.reason})`;
+function inertRows(config) {
+    const routes = routesOf(config);
+    return [...ACTOR_ROWS, ...CONFIG_ROWS].filter((row) => row.applies(config, routes));
 }
 /**
- * The fields a config sets that its route does not read, each as `field` or `field (reason)`. A v2
- * file gets them as one warning; a v3 study is refused for any of them.
+ * The fields a config sets that its route does not read, each as `field` or `field (reason)`.
+ * parseStudy refuses a study for any of them.
  */
 export function inertFieldLabels(config) {
-    const routes = routesOf(config);
-    const inert = [];
-    for (const [index, actor] of actorsOf(config).entries()) {
-        for (const row of ACTOR_ROWS)
-            if (row.applies(actor, routes))
-                inert.push(rowLabel(row, `actors[${index}].`));
-    }
-    for (const row of CONFIG_ROWS)
-        if (row.applies(config, routes))
-            inert.push(rowLabel(row));
-    return inert;
+    return inertRows(config).map((row) => row.reason === undefined ? row.field : `${row.field} (${row.reason})`);
 }
 /**
  * The same fields as `inertFieldLabels`, as paths without their reasons, such as
- * `actors[0].lanes[].entry` or `execution.timeoutMs`. `humanish migrate` drops each one.
+ * `participants[].entry` or `execution.timeoutMs`. `humanish migrate` drops each one.
  */
 export function inertFieldPaths(config) {
-    const routes = routesOf(config);
-    const paths = [];
-    for (const [index, actor] of actorsOf(config).entries()) {
-        for (const row of ACTOR_ROWS)
-            if (row.applies(actor, routes))
-                paths.push(`actors[${index}].${row.field}`);
-    }
-    for (const row of CONFIG_ROWS)
-        if (row.applies(config, routes))
-            paths.push(row.field);
-    return paths;
+    return inertRows(config).map((row) => row.field);
+}
+/**
+ * The warning for `execution.egressAllow` on a route that ignores it, or undefined. Only the
+ * terminal route creates its sandbox with the list as an outbound allowlist; on any other route the
+ * study author would trust a list that blocks nothing. `humanish study check` and every run print
+ * it, and the run records it in its bundle.
+ * Removed in 0.112.0: deprecated on 2026-10-05. 0.112.0 refuses the field off the terminal route.
+ */
+export function egressAllowIgnoredWarning(config) {
+    if (config.execution?.egressAllow === undefined || config.route === "terminal")
+        return undefined;
+    return `\`execution.egressAllow\` is ignored on route: ${config.route}. Only route: terminal creates its sandbox with that outbound allowlist, and this route's browser desktops can reach any site. Remove the field: humanish 0.112.0 refuses it on every route except terminal.`;
 }
 // Report fields that are present but not yet consumed by the engine, so a user never trusts a
 // setting that silently does nothing.
@@ -344,6 +287,9 @@ export function forwardDeclaredWarnings(config) {
         : [
             `These fields are set, but no route reads them yet, so they have no effect: ${inert.join(", ")}.`,
         ];
+    const egressIgnored = egressAllowIgnoredWarning(config);
+    if (egressIgnored !== undefined)
+        warnings.push(egressIgnored);
     // A declared cap below the participant count is legal but loud: the roster promises N live actors
     // and the cap delivers waves of M. Say so up front (inspect + dry-run + run): a green run in
     // waves is otherwise indistinguishable from the all-live run the author meant.

package/dist/substrates/local/runtime-config.js

@@ -1,23 +1,24 @@
-import { actorOf, actorsOf, participantList } from "../../study/study-fields.js";
+import { participantList } from "../../study/study-fields.js";
 // The runtime image enforces a 30-minute lifetime; reserve setup/teardown room.
 export const LOCAL_BROWSER_LIFETIME_MS = 30 * 60_000;
 const MAX_SESSION_MS = 20 * 60_000;
 export function isLocalBrowserStudy(config) {
     return (config.subject.source === "app-url" &&
         config.execution?.target === "local" &&
-        ["local-agent", "openai-computer-use"].includes(actorOf(config)?.type ?? ""));
+        ["local-agent", "openai-computer-use"].includes(config.actor?.type ?? ""));
 }
 /** Defaults for the explicitly selected local substrate; hosted configurations are untouched. */
 export function localBrowserDefaults(config) {
-    if (!isLocalBrowserStudy(config))
+    const actor = config.actor;
+    if (!isLocalBrowserStudy(config) || actor === undefined)
         return config;
     return {
         ...config,
-        actors: actorsOf(config).map((actor) => ({
+        actor: {
             ...actor,
             model: actor.model ?? "gpt-6-astra",
             reasoningEffort: actor.reasoningEffort ?? "low",
-        })),
+        },
         execution: {
             ...config.execution,
             timeoutMs: config.execution?.timeoutMs ?? MAX_SESSION_MS,
@@ -26,19 +27,18 @@ export function localBrowserDefaults(config) {
                 resolution: config.execution?.desktop?.resolution ?? [960, 720],
             },
         },
-        ...(config.review?.analysis === undefined && actorOf(config)?.type === "local-agent"
+        ...(config.review?.analysis === undefined && actor.type === "local-agent"
             ? { review: { ...config.review, analysis: { provider: "codex" } } }
             : {}),
     };
 }
 export function localBrowserUnsupportedReason(config) {
-    const actor = actorOf(config);
+    const actor = config.actor;
     const desktop = config.execution?.desktop;
     if ((config.execution?.timeoutMs ?? MAX_SESSION_MS) > MAX_SESSION_MS) {
         return "Local browser sessions currently support at most 20 minutes, within the runtime's 30-minute lifetime.";
     }
-    if (actorsOf(config).length !== 1 ||
-        !actor ||
+    if (!actor ||
         (actor.type === "local-agent" && actor.localAgent !== undefined && actor.localAgent !== "codex")) {
         return "Local browser studies support only Codex local-agent or openai-computer-use participants.";
     }
@@ -63,10 +63,8 @@ export function localBrowserUnsupportedReason(config) {
             actor.reasoningEffort !== "low" ||
             participantList(config)?.some((entry) => entry.reasoningEffort !== undefined && entry.reasoningEffort !== "low") ||
             actor.maxOutputTokens !== undefined ||
-            config.execution?.caps?.maxUsd !== undefined ||
-            config.execution?.caps?.maxTotalUsd !== undefined ||
-            config.scenario?.caps?.maxUsd !== undefined ||
-            config.scenario?.caps?.maxTotalUsd !== undefined)) {
+            config.caps?.maxUsd !== undefined ||
+            config.caps?.maxTotalUsd !== undefined)) {
         return "Local Codex participants currently use gpt-6-astra at low effort. Account dollar/output-token caps are unavailable; use API participants for those controls.";
     }
     for (const target of [

package/docs/architecture/browser-control.md

@@ -62,8 +62,15 @@ runtime-management method. Initial target navigation remains an adapter-owned
 operation.
 
 Replies acknowledge completion or contain a finite `ComputerUseExecutorError` code and
-`not_dispatched` / `outcome_uncertain` disposition. They never include raw
+`not_dispatched` / `outcome_uncertain` disposition. An `action_rejected` /
+`not_dispatched` refusal may add a `reason` from a fixed list (`extra_tab`), which
+the study loop turns into a hint the participant can act on. They never include raw
 exception prose, typed text, page URLs, or browser errors in their error fields.
+A failure the driver did not declare may add a `diagnostic` of two fixed words: the
+step that failed (such as `insert_text`) and a category (`target_closed`,
+`detached`, `navigation`, `timeout`, `protocol_error`, `channel_closed` or
+`unknown`). The guest picks the category from the error's class and known message
+shapes and then drops the message; the host prints a fixed sentence for each word.
 A generic driver exception after invocation is uncertain; only a genuine typed
 driver declaration can attest that input was never dispatched.
 
@@ -96,7 +103,10 @@ Observation requires a PNG and state signature. It may include bounded URL,
 title, text, fractional scroll position and heard speech; those remain
 runtime-only under the existing loop contract. Arbitrary `appState` is refused
 because v1 has no closed schema for it. The protocol does not truncate strings,
-round coordinates, or silently drop unsupported state.
+round coordinates, or silently drop unsupported state. A Codex participant's
+`humanish_ui` call is checked before it reaches the protocol: a wait longer than 30 seconds is
+shortened to 30 seconds there, and the trace records a `wait shortened` notice with both
+durations.
 
 Click, double-click, move, scroll and drag may carry `heldKeys`, which the
 OpenAI provider maps from its computer tool's `keys`. The Codex participant's

package/docs/architecture/guest-desktop.md

@@ -38,6 +38,11 @@ world checks actual document focus and binds preparation to the editable element
 page changes, additional tabs, dialogs, iframe focus and ambiguous focus are
 refused. The owner acquires the one page and native window before untrusted
 navigation. The driver never chooses another tab or brings one to the front.
+Playwright emulates focus in every page it drives, so the focus probe also passes
+in a background tab and cannot tell which tab is in front; text therefore needs the
+owned page to be the context's only page. That refusal carries the fixed reason
+`extra_tab` over browser control, and the study loop tells the participant to close
+the other tab.
 Focus can change between protocol messages; this is not atomic element-targeted
 input or a general multi-window driver.
 
@@ -56,7 +61,8 @@ text paths likewise need application readback to establish task outcomes.
 Native children use fixed paths and a minimal explicit environment. Operator
 credentials and inherited Xauthority are not forwarded. Native address-bar text travels over the
 helper's stdin; web text travels over the private browser pipe, never a shell. Helpers have bounded deadlines and output;
-raw diagnostic text is never returned as an executor error. Only an acquired,
+raw diagnostic text is never returned as an executor error. A text port failure the
+driver did not declare carries only a fixed step and category. Only an acquired,
 still-live child handle authorizes termination. If capture-helper exit cannot
 be confirmed, its private files stay for runtime-owner reclamation.
 

package/docs/architecture/terminal-product-route.md

@@ -104,8 +104,9 @@ execution:
 Codex command receives the nonsecret value `humanish-egress-auth-placeholder`
 under `CODEX_API_KEY`, plus `CODEX_CA_CERTIFICATE` pointing at E2B's existing
 system CA bundle (`/etc/ssl/certs/ca-certificates.crt`) so TLS verification trusts
-the platform's proxy CA. humanish does not disable TLS verification or download
-an unauthenticated CA. The sandbox receives no raw runtime key in command env, sandbox env,
+the platform's proxy CA. `humanish doctor` run inside the sandbox reports that
+`CODEX_API_KEY` holds this placeholder and that no usable key is available.
+humanish does not disable TLS verification or download an unauthenticated CA. The sandbox receives no raw runtime key in command env, sandbox env,
 files, metadata, or captured evidence. The host still scrubs the actual key from
 output and errors, including errors during sandbox creation.
 

package/docs/contracts/schemas.md

@@ -59,10 +59,19 @@ workflow without leaking private upstream truth into core.
 
 ## Study File
 
-Schema: `humanish.study.v3`. `src/study/parse/study-v3.ts` rewrites a v3 document into the
-normalized config in `src/study/types.ts`, which `src/study/config.ts` parses. humanish refuses a
-`humanish.lab.v2` file with `HUMANISH_STUDY_V2_UNSUPPORTED`, whose message names
-`humanish migrate <path>`; migrate converts the file to v3.
+Schema: `humanish.study.v3`. `src/study/config.ts` parses a v3 document into `StudyConfig`
+(`src/study/types.ts`), which has the file's keys; `src/study/parse/front.ts` checks the route and
+the forms of `participants`, `surfaces` and `caps` it takes. humanish refuses a `humanish.lab.v2`
+file with `HUMANISH_STUDY_V2_UNSUPPORTED`, whose message names `humanish migrate <path>`; migrate
+converts the file to v3.
+
+The parsed config is the file with defaults filled: a `participants` entry with a `count` expanded
+into its participants, `comms.email.recipients` and a shared world's `execution.concurrency`
+filled, `kind: real` added beside an email `connection`, and a local browser study's model,
+effort, timeout and resolution. `humanish study show --json` prints that config, and `parseStudy`
+reads it back to the same config. Before 0.111.0, `StudyConfig` had the `humanish.lab.v2` keys
+(`actors`, `execution.caps`, the `scenario` object, `subject.topology`); the 0.111.0 release notes
+map each one to its v3 key.
 
 A study declares its route and composes code primitives; it is not a hardcoded kind. The
 top-level keys:
@@ -969,14 +978,25 @@ Core-owned fields:
   kept it through `previous_response_id`) or `explicit_context` (the server kept
   none). `explicitReason` says why: `configured` (`zeroDataRetention`) or
   `zdr_rejection` (the organization rejected server-side state; `switchedAt` and
-  `switchedAtRequest` say when). In `explicit_context` each request carries the
+  `switchedAtRequest` say when). With `zdr_rejection`, `rejection` names the
+  answer that made the switch: `zero_data_retention` (the error named it),
+  `previous_response` (a 400 that refused or could not find the
+  `previous_response_id`) or `stored_item` (a 404 for an item the server never
+  kept, "Item with id '...' not found"). In `explicit_context` each request carries the
   conversation from the client, with `store: false` and the reasoning returned
   in encrypted form. It carries the opening message, every exchange of a reply
   with the outputs that answered it, and the latest reply. Past an estimated
-  64,000 input tokens the opening screenshot is dropped first, then the oldest
-  exchanges become lines of a note, sent as an assistant message, that keeps
-  their reasoning summaries, messages and actions as text. The two newest
-  exchanges are always carried whole, even when they alone pass the budget. `summarizedTurns` counts the earlier exchanges the latest
+  64,000 input tokens it is cut down to 32,000 in one step: the opening
+  screenshot is dropped first, then the oldest exchanges become lines of a note,
+  sent as an assistant message, that keeps their reasoning summaries, messages
+  and actions as text, with any text that came back with their screenshots.
+  Past 32,000 characters the note keeps its first four lines and its newest
+  ones, and names the turns between them as not listed.
+  The two newest exchanges are always carried whole, even when they alone pass
+  the budget. Between cuts each request starts with the whole previous request,
+  so the provider's prompt cache can serve all of it; the request after a cut is
+  billed as new input. `tokenUsage.turns` has each request's `cachedInput` and
+  `cacheWriteInput`. `summarizedTurns` counts the earlier exchanges the latest
   `explicit_context` request no longer carried whole: lines of the note, or
   only counted once the note reached its cap.
   `requests[]` has one entry per participant request: its `mode` and, in
@@ -1552,6 +1572,16 @@ Refusals:
   a preview or scripted study, `createProvider` off computer use, or `prepareDesktop` where no E2B
   desktop exists. The message names the option and the route. The same code refuses a field
   `RunStudyOptions` no longer has (below); that message names the field and where its job went.
+- `HUMANISH_STUDY_V2_UNSUPPORTED`: the config is `humanish.lab.v2`, or it still sets a
+  `StudyConfig` field of humanish 0.110 that 0.111.0 renamed: `actors`, a `scenario` object,
+  `execution.caps`, `subject.topology`, `personas`, or `count`, `lanes`, `roster` or `laneFocus` on
+  `actor`. The message names each one's v3 field. The
+  planners read only the v3 fields, so a budget left in `execution.caps` would otherwise run
+  uncapped.
+- `HUMANISH_STUDY_INVALID`: the config has no `actor` object, or its `route` is missing or is not
+  the route its subject and actor take. The message is the one `parseStudy` gives.
+
+`runStudy` checks the config before the options, so a config refusal comes first.
 
 `rerun.laneIds`, the older name of `rerun.participantIds`, was removed in 0.107.0. A caller that
 still passes it is refused with `HUMANISH_STUDY_OPTION_UNSUPPORTED`; use `rerun.participantIds`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.110.4",
+  "version": "0.111.1",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",

package/dist/study/parse/study.d.ts

@@ -1,38 +0,0 @@
-import { type StudyConfig, type StudyParseFailure, type StudyScenarioCaps, type StudyV3 } from "../types.js";
-interface StudyV3Options {
-    /**
-     * `report`, for `humanish migrate`: list the fields the route does not read in `inert`, as v2
-     * paths, in place of refusing the study for them, and give the checks' messages as they wrote
-     * them, in the v2 spelling of the file migrate converts. A shared world may then give
-     * `participants` as a count or leave it out, as a v2 file could (readStudyFront).
-     */
-    readonly inert?: "refuse" | "report";
-}
-type StudyV3ParseResult = {
-    ok: true;
-    config: StudyV3;
-    warnings: string[];
-    inert?: string[];
-} | StudyParseFailure;
-type Parsed<T> = {
-    ok: true;
-    value: T;
-} | StudyParseFailure;
-/**
- * Validate a parsed humanish.study.v3 document into a StudyV3, with the messages parseStudy gives.
- * Pure: the caller owns file IO. parseStudy refuses a humanish.lab.v2 document before this runs.
- */
-export declare function parseStudyV3(raw: unknown, options?: StudyV3Options): StudyV3ParseResult;
-/**
- * A v3 study in the v2 spelling: the actor holds its participants, `caps` moves under `execution`
- * or `scenario`, and a shared world is `subject.topology: shared-world`. The checks that read more
- * than one section run on this view until StudyConfig has the v3 shape.
- */
-export declare function toLegacy(study: StudyV3): StudyConfig;
-/**
- * A caps block's values. A value that is not a non-negative number refuses the study: a cap that
- * does nothing must not look like one that holds. readStudyFront has checked the keys against the
- * route; migrate checks a v2 file's two blocks with it.
- */
-export declare function parseCaps(raw: unknown): Parsed<StudyScenarioCaps | undefined>;
-export {};