humanish 0.111.4 → 0.113.0

package/dist/verify/liveness.d.ts

@@ -14,8 +14,8 @@ export interface UnfinishedRun {
 }
 /**
  * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
- * rule: its status record when it has a usable one, else a participant still `running` in its
- * bundle's `simulations[]`. Nothing for a finished run.
+ * rule: its bundle outcome first, then usable status, then the bundle's simulations. Nothing
+ * for a finished run.
  */
 export declare function runNotFinished(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, nowMs?: number): Promise<{
     warnings: string[];

package/dist/verify/liveness.js

@@ -7,7 +7,7 @@ import path from "node:path";
 import { readRunJsonIfExists, readRunTextIfExists } from "../run/locate.js";
 import { isRecord } from "../run/type-guards.js";
 import { RECLAIM_RECEIPT_ARTIFACT } from "../run/reclaim.js";
-import { runLiveness } from "../run/run-index.js";
+import { runLiveness } from "../run/liveness.js";
 import { parseSandboxReceipts, SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { RUN_STATUS_FILE } from "../run/status.js";
 import { plural } from "../run/text.js";
@@ -17,8 +17,8 @@ const RUN_NOT_FINISHED = "RUN_NOT_FINISHED";
 const GONE_STATES = new Set(["killed", "already-gone"]);
 /**
  * One warning, and the unfinished-run facts, when the run is not finished, by the run index's
- * rule: its status record when it has a usable one, else a participant still `running` in its
- * bundle's `simulations[]`. Nothing for a finished run.
+ * rule: its bundle outcome first, then usable status, then the bundle's simulations. Nothing
+ * for a finished run.
  */
 export async function runNotFinished(runPaths, bundle, nowMs = Date.now()) {
     const runId = path.basename(runPaths.absoluteRunRoot);
@@ -27,7 +27,10 @@ export async function runNotFinished(runPaths, bundle, nowMs = Date.now()) {
     if (liveness === "finished")
         return { warnings: [] };
     const seen = [];
-    if (record === undefined) {
+    if (bundle.outcome?.state === "interrupted") {
+        seen.push(`run.json records interruption by ${bundle.outcome.signal} at ${bundle.outcome.at}`);
+    }
+    else if (record === undefined) {
         const running = bundle.simulations.filter((simulation) => simulation.status === "running");
         seen.push(`the run has no usable ${RUN_STATUS_FILE} and ${running.length} of ${bundle.simulations.length} simulations are still running`);
     }

package/docs/architecture/actor-contract.md

@@ -350,22 +350,36 @@ this paragraph is the record of that decision.
 
 `ComputerUseProvider.debrief` is an optional read-only request after a structured
 `stopWhen` or dwell stop. It returns a `ComputerUseTurn` with `closingReport` containing
-`summary` and `frictionReports`; an empty friction list is valid. The loop rejects
+`summary`, `frictionReports` and `impressions`; an empty friction or impressions list is valid,
+and a report without `impressions` (an older provider) is still accepted. The loop rejects
 actions, pending safety checks, and invalid report shapes. It redacts accepted
 reports, records them in `ActorTrace.debrief`, and projects one readable message
-without invoking action or communication callbacks.
+without invoking action or communication callbacks. Each impression becomes its own message
+and goes to `ActorTrace.impressions`; a session without them records why in the same field.
+A turn that ends the session itself may carry `closingReport` too, and the loop keeps its
+impressions the same way without a second request.
+
+`ComputerUseProvider.requestImpressions` is the optional request after the participant ended
+the session itself without impressions. It asks for impressions only, returns them as
+`impressions` on the turn, and follows the debrief's rules and guards. The loop records it as
+`ActorTrace.debrief` with `trigger: "participant_end"` and no report, so the participant's
+reason, outcome and friction come from its final message as before. A failed, timed-out or
+cut-off request leaves `ActorTrace.impressions` as `not_collected` with the reason.
 
 This request uses the final observation and retained provider history. It does
 not expose the hidden stop criterion or change the original task outcome. It is
-skipped before any participant turn, after natural completion, without provider
-support, or without remaining time and known budget. An attempted request's
+skipped before any participant turn, after natural completion (apart from the impressions-only
+request), without provider support, or without remaining time and known budget. An attempted request's
 unreported usage remains an unknown cost line. `counts.debriefCalls` is separate
 from interaction turns, and reported usage contributes to aggregate cost.
 
 The OpenAI implementation makes one request with tools disabled and structured
-output; no HTTP or policy retries. Stateless/ZDR mode does not offer retrospective
+output; no HTTP or policy retries. Its output limit is 3072 tokens, or the declared
+`maxOutputTokens` when lower. Stateless/ZDR mode does not offer retrospective
 reporting: its client-carried conversation summarizes its oldest turns past a token
-budget, so it may not hold the whole session a retrospective report needs. The
+budget, so it may not hold the whole session a retrospective report needs. It does offer
+the impressions-only request, which reads the carried conversation: its newest
+exchanges whole and earlier turns as a text note. The
 [paired live receipt](https://github.com/danielgwilson/humanish/blob/main/docs/evidence/computer-use/structured-closing-report-2026-09-05.md)
 records both report recovery and control failures in the separate legacy parser.
 

package/docs/architecture/terminal-product-route.md

@@ -84,6 +84,20 @@ at the base tier, with cached input at the cached rate, and says so with
 checked against `caps.maxUsd` keeps the provider line unmeasured, and the studied
 product's no-spend boundary still needs separate interpretation.
 
+## Participant telemetry
+
+Terminal participant commands and product setup receive `DO_NOT_TRACK=1` by default.
+Their child processes inherit it, so studied CLIs that honor the convention can exclude
+synthetic usage. To study the product's telemetry behavior, set
+`execution.terminal.doNotTrack: false`; humanish then leaves the variable unset.
+Only booleans are accepted, and `true` or an omitted field enables the default.
+
+The resolved `doNotTrack` boolean is recorded with `humanish.actor-runtime.v1` in
+`actor.json`, `streams[].actor.runtime` in `run.json`, and `runtime` in
+`terminal-ledgers.json`. A dry run records it in the JSON message of its
+`terminal-lab.runtime.declared` event. Older bundles omit it. This records the
+command environment policy; it does not prove that the studied CLI honors the variable.
+
 ## Runtime auth: raw-key placement and remaining provider access
 
 `execution.runtimeAuth: openai-egress` is the default: a study that declares no

package/docs/contracts/feedback.md

@@ -66,7 +66,9 @@ Listing does not create a draft or check public-sharing eligibility.
 
 For completed computer-use and shared-world sessions, participant-reported
 friction comes from the redacted closing report, a completed debrief's
-`frictionReports`, and observed-report clauses in earlier messages.
+`frictionReports`, and observed-report clauses in earlier messages. The
+participant's closing impressions (`ActorTrace.impressions`) are opinions about
+the product and never count as friction.
 Matching `stopWhen` or ending a dwell window does not discard an earlier
 report or change the successful completion verdict. Exact repeated reports
 appear once in the participant's candidate. Harness notices, reasoning, and observed
@@ -84,6 +86,11 @@ was not repeated in the message trace.
 Builds structured feedback from the first usable run candidate, or the candidate
 selected with `--candidate`. With no candidate, a live run produces a summary of
 its recorded review; that fallback does not add a finding to the candidate list.
+With `--analysis` and `--finding`, the draft is built from that analysis finding
+instead. When the finding's observations cite a participant's closing impression,
+`actual` quotes it after the observations as
+`Participant <id> said at the end (<kind>): <text>`. An impression is quoted only
+when the cited evidence entry carries its text whole; uncited impressions stay out.
 A dry run tests no product behavior, so `draft`, `verify`, `issue` and
 `issue-url` refuse it with `HUMANISH_FEEDBACK_REQUIRES_LIVE_RUN`. All drafts
 require a verified `share_ready` live run and are written under the run bundle,

package/docs/contracts/run-bundle.md

@@ -6,6 +6,13 @@
 source of truth. This page explains the stable public fields and the extension rules; it does not
 version the runtime separately.
 
+Terminal runs record the resolved telemetry setting as `doNotTrack` in
+`streams[].actor.runtime` (`humanish.actor-runtime.v1`), also retained in `actor.json`
+and `terminal-ledgers.json`. `true` means participant and product setup commands receive
+`DO_NOT_TRACK=1`; `false` means humanish leaves it unset. Dry runs record the same boolean
+in the JSON message of the `terminal-lab.runtime.declared` event. Older bundles omit it.
+The setting does not attest that the studied CLI honors the variable.
+
 ## Purpose
 
 A run bundle is the durable evidence packet for one harness run. It should be
@@ -154,6 +161,9 @@ writing it, and on runs recorded before the field existed. For those, readers
 take liveness from `status.json` and, for an older finished run, its `ok` and
 `execution` from `status.json`'s `outcome`. That record is the only copy of an
 older run's `ok`; for a run with `outcome` in `run.json`, `status.json` copies it.
+The bundle's outcome wins even if the process stopped before updating `status.json`.
+Without an outcome or a usable status record naming the run, a bundle with a simulation still
+`running` reads as interrupted. A fresh status record keeps an in-progress bundle running.
 
 Every surface that shows whether a run passed calls `runDisplay`
 (`src/run/display.ts`) with the run's liveness, verdict and `ok`: the Observer

package/docs/contracts/schemas.md

@@ -24,38 +24,38 @@ workflow without leaking private upstream truth into core.
 
 ## Contract Index
 
-| Contract                          | Schema                                                                                                                                                                         | Public-safe fixture                                                                 |
-| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
-| Run bundle                        | `humanish.run-bundle.v1`                                                                                                                                                       | `synthetic-run-bundle`                                                              |
-| Adapter                           | `humanish.adapter.v1`                                                                                                                                                          | `synthetic-cli-adapter`                                                             |
-| Study file                        | `humanish.study.v3`                                                                                                                                                            | `first-run`                                                                         |
-| Persona                           | `humanish.persona.v1`                                                                                                                                                          | `synthetic-maintainer`                                                              |
-| Scenario                          | `humanish.scenario.v1`                                                                                                                                                         | `first-run-smoke`                                                                   |
-| Actor trace                       | `humanish.actor-trace.v1`                                                                                                                                                      | `synthetic-actor-trace`                                                             |
-| Substrate                         | reserved (never shipped)                                                                                                                                                       | none                                                                                |
-| Evidence stream                   | reserved (streams live inside the run bundle)                                                                                                                                  | see [`run-bundle.md`](run-bundle.md)                                                |
-| Review                            | `humanish.review.v1`                                                                                                                                                           | `contract-proof-review`                                                             |
-| Study analysis                    | `humanish.study-analysis.v1`                                                                                                                                                   | see [study analysis](study-analysis.md) and synthetic analysis fixtures in `tests/` |
-| Study analysis correction         | `humanish.study-analysis-correction.v1`                                                                                                                                        | see [study analysis](study-analysis.md#human-review-and-sharing)                    |
-| Analysis findings view            | `humanish.analysis-findings.v1` (`review --json` field `analysis`; read-only projection of the selected analysis)                                                              | see [study analysis](study-analysis.md#reading-findings)                            |
-| Analysis execution receipt        | `humanish.analysis-execution.v1`                                                                                                                                               | see [study analysis](study-analysis.md#durable-records)                             |
-| Analysis execution start          | `humanish.analysis-execution-start.v1`                                                                                                                                         | see [study analysis](study-analysis.md#durable-records)                             |
-| Verification                      | `humanish.verify-result.v1`                                                                                                                                                    | `five-check-verify`                                                                 |
-| Policy                            | `humanish.policy.v1` (fixture-only; not engine-validated)                                                                                                                      | `public-safety-policy`                                                              |
-| Feedback                          | `humanish.feedback.v1`                                                                                                                                                         | `public-safe-feedback`                                                              |
-| Terminal cost ledger              | `humanish.terminal-cost-ledger.v1`                                                                                                                                             | see Terminal Cost Ledger below                                                      |
-| Terminal no-spend proof           | `humanish.terminal-no-spend-proof.v1`                                                                                                                                          | see Terminal Cost Ledger below                                                      |
-| Pricing (operator-editable rates) | `humanish.pricing.v1` (`src/run/pricing.ts`; dated per-model + E2B desktop rates)                                                                                              | see Run Cost Summary And Estimated Actor Cost below                                 |
-| Run cost summary                  | `humanish.run-cost-summary.v1` (additive `RunBundle.cost`; estimate, never a charge)                                                                                           | see Run Cost Summary And Estimated Actor Cost below                                 |
-| Estimated actor cost              | `humanish.actor-estimated-cost.v1` (additive `ActorTrace.estimatedCost`)                                                                                                       | see Run Cost Summary And Estimated Actor Cost below                                 |
-| Model settings                    | `humanish.model-settings.v1` (additive `ActorTrace.modelSettings`; the reasoning effort the request carried)                                                                   | see Actor Trace below                                                               |
-| Affordance use                    | `humanish.affordance-use.v1` (additive `ActorTrace.affordanceUse`; per-class counts of the routes an actor took)                                                               | see Affordance Use below                                                            |
-| Adapter score                     | `humanish.adapter-score.v1` (`RunBundle.adapterScore`; namespaced; route-specific acceptance semantics)                                                                        | see Product-Adapter Extension Seam below                                            |
-| Adapter artifact                  | `humanish.adapter-artifact.v1` (`RunBundle.adapterArtifacts[]`; namespaced; local relative proof references)                                                                   | see Product-Adapter Extension Seam below                                            |
-| Shared-world evidence             | `humanish.shared-world.v1` (additive `RunBundle.sharedWorld` + `RunBundle.attributionClass`; `topologyMode: sequential \| concurrent`)                                         | see Shared-World Evidence below                                                     |
-| Comms thread                      | `humanish.comms-thread.v1` (off-app email/SMS the app sent, captured; a `kind: log` run-dir artifact of digests only: from/to/subject/link digests + one OTP count, never raw) | see `comms` under Study File                                                        |
-| Serve result                      | `humanish.serve-result.v1` (`src/observer/serve.ts` is authoritative)                                                                                                          | none (command result envelope; see Serve Result below)                              |
-| Serve control plane               | reserved (`/_humanish/api/*` answers `501` `HUMANISH_SERVE_CONTROL_PLANE_DISABLED` in v1)                                                                                      | none                                                                                |
+| Contract                          | Schema                                                                                                                                                                                                                                                    | Public-safe fixture                                                                 |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| Run bundle                        | `humanish.run-bundle.v1`                                                                                                                                                                                                                                  | `synthetic-run-bundle`                                                              |
+| Adapter                           | `humanish.adapter.v1`                                                                                                                                                                                                                                     | `synthetic-cli-adapter`                                                             |
+| Study file                        | `humanish.study.v3`                                                                                                                                                                                                                                       | `first-run`                                                                         |
+| Persona                           | `humanish.persona.v1`                                                                                                                                                                                                                                     | `synthetic-maintainer`                                                              |
+| Scenario                          | `humanish.scenario.v1`                                                                                                                                                                                                                                    | `first-run-smoke`                                                                   |
+| Actor trace                       | `humanish.actor-trace.v1`                                                                                                                                                                                                                                 | `synthetic-actor-trace`                                                             |
+| Substrate                         | reserved (never shipped)                                                                                                                                                                                                                                  | none                                                                                |
+| Evidence stream                   | reserved (streams live inside the run bundle)                                                                                                                                                                                                             | see [`run-bundle.md`](run-bundle.md)                                                |
+| Review                            | `humanish.review.v1`                                                                                                                                                                                                                                      | `contract-proof-review`                                                             |
+| Study analysis                    | `humanish.study-analysis.v1` (prompt `study-evidence-7` adds `findings[].headline`, `findings[].experience` and `designFindings[]`; older artifacts omit them; `study-evidence-8` adds participant impressions to the instructions, with no field change) | see [study analysis](study-analysis.md) and synthetic analysis fixtures in `tests/` |
+| Study analysis correction         | `humanish.study-analysis-correction.v1`                                                                                                                                                                                                                   | see [study analysis](study-analysis.md#human-review-and-sharing)                    |
+| Analysis findings view            | `humanish.analysis-findings.v1` (`review --json` field `analysis`; read-only projection of the selected analysis)                                                                                                                                         | see [study analysis](study-analysis.md#reading-findings)                            |
+| Analysis execution receipt        | `humanish.analysis-execution.v1`                                                                                                                                                                                                                          | see [study analysis](study-analysis.md#durable-records)                             |
+| Analysis execution start          | `humanish.analysis-execution-start.v1`                                                                                                                                                                                                                    | see [study analysis](study-analysis.md#durable-records)                             |
+| Verification                      | `humanish.verify-result.v1`                                                                                                                                                                                                                               | `five-check-verify`                                                                 |
+| Policy                            | `humanish.policy.v1` (fixture-only; not engine-validated)                                                                                                                                                                                                 | `public-safety-policy`                                                              |
+| Feedback                          | `humanish.feedback.v1`                                                                                                                                                                                                                                    | `public-safe-feedback`                                                              |
+| Terminal cost ledger              | `humanish.terminal-cost-ledger.v1`                                                                                                                                                                                                                        | see Terminal Cost Ledger below                                                      |
+| Terminal no-spend proof           | `humanish.terminal-no-spend-proof.v1`                                                                                                                                                                                                                     | see Terminal Cost Ledger below                                                      |
+| Pricing (operator-editable rates) | `humanish.pricing.v1` (`src/run/pricing.ts`; dated per-model + E2B desktop rates)                                                                                                                                                                         | see Run Cost Summary And Estimated Actor Cost below                                 |
+| Run cost summary                  | `humanish.run-cost-summary.v1` (additive `RunBundle.cost`; estimate, never a charge)                                                                                                                                                                      | see Run Cost Summary And Estimated Actor Cost below                                 |
+| Estimated actor cost              | `humanish.actor-estimated-cost.v1` (additive `ActorTrace.estimatedCost`)                                                                                                                                                                                  | see Run Cost Summary And Estimated Actor Cost below                                 |
+| Model settings                    | `humanish.model-settings.v1` (additive `ActorTrace.modelSettings`; the reasoning effort the request carried)                                                                                                                                              | see Actor Trace below                                                               |
+| Affordance use                    | `humanish.affordance-use.v1` (additive `ActorTrace.affordanceUse`; per-class counts of the routes an actor took)                                                                                                                                          | see Affordance Use below                                                            |
+| Adapter score                     | `humanish.adapter-score.v1` (`RunBundle.adapterScore`; namespaced; route-specific acceptance semantics)                                                                                                                                                   | see Product-Adapter Extension Seam below                                            |
+| Adapter artifact                  | `humanish.adapter-artifact.v1` (`RunBundle.adapterArtifacts[]`; namespaced; local relative proof references)                                                                                                                                              | see Product-Adapter Extension Seam below                                            |
+| Shared-world evidence             | `humanish.shared-world.v1` (additive `RunBundle.sharedWorld` + `RunBundle.attributionClass`; `topologyMode: sequential \| concurrent`)                                                                                                                    | see Shared-World Evidence below                                                     |
+| Comms thread                      | `humanish.comms-thread.v1` (off-app email/SMS the app sent, captured; a `kind: log` run-dir artifact of digests only: from/to/subject/link digests + one OTP count, never raw)                                                                            | see `comms` under Study File                                                        |
+| Serve result                      | `humanish.serve-result.v1` (`src/observer/serve.ts` is authoritative)                                                                                                                                                                                     | none (command result envelope; see Serve Result below)                              |
+| Serve control plane               | reserved (`/_humanish/api/*` answers `501` `HUMANISH_SERVE_CONTROL_PLANE_DISABLED` in v1)                                                                                                                                                                 | none                                                                                |
 
 ## Study File
 
@@ -296,6 +296,14 @@ instruction?, target?, entry?, host?, reasoningEffort?, stopWhen?, dwell? }` bec
   metadata; with `openai-egress` it stays in the host-side E2B header transform
   set at sandbox creation, and the agent gets a placeholder. A dry-run neither
   reads nor injects it;
+- `execution.terminal.doNotTrack`: boolean, default `true`. Terminal participant and product
+  setup commands receive `DO_NOT_TRACK=1`. Set `false` to leave that variable unset when
+  studying the product's telemetry behavior. Non-boolean values are refused at parse.
+  The resolved boolean is `doNotTrack` in `humanish.actor-runtime.v1`: `actor.json`,
+  `streams[].actor.runtime` in `run.json`, and `runtime` in `terminal-ledgers.json` for live
+  runs; the JSON message of the `terminal-lab.runtime.declared` event for dry runs.
+  Older bundles omit this field. It records the command environment policy, not whether
+  the studied CLI honored it;
 - `mode`: `dry-run` (a synthetic bundle, no spend; the default) or `live`. On the
   scripted route `live` gates real browser actuation against the declared app.
   Provider spend stays $0 there by mechanism (no model runs);
@@ -962,8 +970,9 @@ Core-owned fields:
 - optional `modelSettings.maxOutputTokens`: the declared positive integer
   `actor.maxOutputTokens`, passed to every first-party OpenAI CUA response
   request, including reasoning output. Absent when undeclared. The first request
-  of a session and closing reports use `min(maxOutputTokens, 1024)`, or 1024 when
-  undeclared; the first request also carries the opening screenshot as an
+  of a session uses `min(maxOutputTokens, 1024)`, or 1024 when undeclared, and
+  closing requests use `min(maxOutputTokens, 3072)`, or 3072 when undeclared; the
+  first request also carries the opening screenshot as an
   `input_image` after the instructions. Unsupported routes,
   custom provider/session hooks, and per-participant overrides fail before allocation.
   This is an output-token limit, not an input-token, request-count or billing cap.
@@ -1006,6 +1015,28 @@ Core-owned fields:
   providers and on earlier bundles
 - optional `affordanceUse` (`humanish.affordance-use.v1`): which kind of route this
   actor took (see Affordance Use below)
+- optional `impressions`: what a computer-use participant said about the product
+  at the end of its session. `status: collected` carries `items[]`, each a
+  `kind` (`unclear`, `unfinished`, `untrustworthy`, `liked`, `missing`,
+  `unlike_my_work`), a redacted first-person `text` of at most 500 characters
+  and the `messageId` of the trace `message` that quotes it as
+  `Impression (<kind>): <text>`. They are not counted in `counts.messages`. Up
+  to six come from the closing account: a completed debrief's report, the
+  participant's own final account when its provider writes a structured one
+  (the Codex participant), or, when the participant ended the session itself
+  without them, one impressions-only request (OpenAI computer-use, threaded or
+  `explicit_context`). That request is recorded as `debrief` with `trigger:
+participant_end` and never has a `report` or `messageId`; it leaves the
+  participant's `reason`, outcome and friction as they were. An empty `items`
+  list means the participant named none. `status: not_collected` carries a
+  `reason`: the closing report or impressions request was skipped or failed
+  (including a reply cut off by the output limit), the participant ended the
+  session without a structured closing account and its provider cannot ask for
+  impressions (the Claude local agent), the closing account had no
+  impressions, or the session stopped before a closing account. Every
+  computer-use loop trace records one; absent on other routes and on earlier
+  bundles. `debrief.report` keeps only `summary` and `frictionReports`.
+  Impression messages do not count as participant-reported friction
 - optional `estimatedCost` (`humanish.actor-estimated-cost.v1`): a token-derived
   cost estimate for this participant (see Run Cost Summary And Estimated Actor Cost).
   It is deliberately a different field from `tokenUsage.costUsd`: a bare

package/docs/contracts/study-analysis.md

@@ -161,6 +161,42 @@ thought. Older reports may omit this field and remain readable. The disclosure
 is model-generated assessment, not an independent completeness audit or a human
 reviewer annotation.
 
+## Headlines and design findings
+
+The `study-evidence-7` prompt writes each finding twice. `headline` is one plain sentence about what
+happened, for a designer, product manager or developer who did not watch the session.
+`experience` is one to three plain sentences: what the person tried, what got in their way, and
+how it seemed to feel. Neither names participant or evidence IDs. A concern known only from what
+participants said still reads as something they said. `title`, `summary` and `observations` keep
+their evidence-level wording, and validation applies to them as before.
+
+The same prompt adds `designFindings`: problems a product designer would notice in the supplied
+captures, whether or not a participant mentioned them. Each has an `id` (`D1`, `D2`, ...), a
+`headline`, the `screen` in plain words, what a designer would `notice`, `whyItMatters` to a
+person using the product, one `suggestion`, a `severity` (`major` when it misleads or blocks,
+`moderate` when it slows or confuses, `minor` when it is polish), a `confidence`,
+`seenByStreamIds` and `evidenceIds`. Validation rejects a design finding that cites no retained
+capture, cites evidence outside the packet, repeats an ID, or lists a participant in
+`seenByStreamIds` without a cited capture of that participant. An empty list means the review found no design
+problem in the captures. The model judges legibility and size from images alone; it does not
+measure text or control sizes.
+
+New provider responses must include `headline` and `experience` on every finding and a
+`designFindings` list. A stored artifact with prompt `study-evidence-7` or later must carry them
+too. Artifacts from earlier prompts load without them and render by title and summary. The
+Observer applies the same prompt-version rules and the same field limits when it reads a saved
+analysis, and treats an analysis that breaks them as unavailable.
+
+The narrative scrub removes a run's known transient values, such as a received one-time code or
+link, from every generated text field. It finds each value as written and in its encoded forms:
+percent-encoded, JSON-escaped, base64, base64url and hex, and where escapes split it. A field
+with a value is stored decoded with the value replaced; a field without one keeps its spelling. A
+known value in any of these forms in an ID, enum or reference refuses the response.
+
+When a reviewer amends a finding, its headline and experience describe the replaced claim.
+Text output, the Observer and feedback drafts show the reviewer's claim in their place and say the
+finding was corrected; the stored analysis keeps the original.
+
 Every observation cites packet-local evidence IDs. The model cannot choose a
 filesystem path or fetch another resource. Validation checks participant
 membership, unique counts, quote fidelity, evidence type and reference
@@ -203,7 +239,7 @@ feedback quotes cite evidence IDs that the run's own `analysis.json` resolves.
 Participant reviews cite distinct packet-local evidence IDs belonging only to
 that participant's stream; source event IDs are not citation IDs. Shared
 interactions can cite multiple included participants in findings and concern
-reviews under the existing exposure rules. The `study-evidence-6` prompt makes
+reviews under the existing exposure rules. The `study-evidence-6` prompt made
 this distinction explicit without changing the validator or historical reports.
 
 Elapsed replay time starts at the first retained capture. It is not a video
@@ -219,11 +255,32 @@ guarantee that the selected capture is the most relevant. Context-only and
 nonvisual evidence retain their basis and original event. All cited moments stay
 available, with exact recording links.
 
+A finding with a headline leads its Observer row with the headline and its open panel with the
+experience. The title, summary, assessment and observations sit in a closed **Evidence**
+disclosure beneath. A **Design findings** section follows the ranked findings, grouped by
+severity, with each cited capture as a thumbnail that opens that frame. Findings without a
+headline render as described below.
+
 Confidence, recovery and the first full evidence limitation remain visible when
 a finding opens. Exposure and remaining unique limits are one disclosure away;
 observation details retain each original claim and its specific limitation.
 This presentation does not rewrite the saved analysis or reviewer corrections.
 
+## Participant impressions
+
+A computer-use participant's closing impressions (`ActorTrace.impressions`) reach the packet as
+ordinary `message` entries of that participant's stream, one per impression, with text
+`Impression (<kind>): <text>`. They are quote-eligible and attributed by `streamId`, so feedback,
+participant_statement observations and design findings can cite them under the existing rules.
+Selection admits them right after the participant's last entry, ahead of the rest of its
+session. The evidence mapping and `captureVersion` are unchanged.
+
+The `study-evidence-8` prompt adds one paragraph: impressions are the participant's own opinions,
+used as participant statements, and an `unlike my work` impression together with a capture of
+that screen is a strong design finding. Validation is unchanged. A design finding still needs at
+least one cited capture, so an impression plus the capture of its screen makes a design finding,
+and an impression alone supports only a finding about what the participant said.
+
 ## Durable records
 
 The frozen `humanish.observer-data.v1` schema is unchanged. A companion
@@ -291,31 +348,35 @@ is disabled. Existing adapter captures and logs retain their contained routes.
 ## Reading findings
 
 `humanish review` prints a run's analysis findings after its participant review, and
-`humanish analyze show` prints them alone. Each finding shows its title, impact, confidence and
-recovery, the participants it affected out of those exposed, the frames its evidence cites with
-their time since the first retained capture, the capture files, its next step and the latest
-human review note. A live run's human output ends with up to three findings, one line each, and
-the `review` command that prints all of them. `analyze show --json` prints the validated
+`humanish analyze show` prints them alone. Each finding leads with its headline and experience,
+then shows its title as `evidence:`, its impact, confidence and recovery, the participants it
+affected out of those exposed, the frames its evidence cites with their time since the first
+retained capture, the capture files, its next step and the latest human review note. A finding
+without a headline starts at its title. Design findings follow, most severe first, each with its
+screen, notice, why it matters, suggestion, who saw it and its capture files. A live run's human
+output ends with up to three findings and up to three design findings, one line each, and the
+`review` command that prints all of them. `analyze show --json` prints the validated
 analysis record and its corrections, as before. Reading findings never starts an analysis.
 
 `review --json` carries the same view as its `analysis` field, schema
 `humanish.analysis-findings.v1`, built in `src/cli/findings.ts`:
 
-| Field                                                                          | Meaning                                                                                                                                                                                                                                                                                                                                       |
-| ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `schema`                                                                       | `humanish.analysis-findings.v1`.                                                                                                                                                                                                                                                                                                              |
-| `runId`                                                                        | The run the view reads.                                                                                                                                                                                                                                                                                                                       |
-| `state`                                                                        | `ready`, `stale`, `running`, `none`, `skipped`, `failed`, `dry_run` or `unavailable`. Only `ready` and `stale` carry findings.                                                                                                                                                                                                                |
-| `reason`                                                                       | The stable code behind a state other than `ready`, or null: an automatic analysis reason such as `AUTOMATIC_ANALYSIS_KEY_MISSING`, a failed attempt's error code, or a load warning such as `ANALYSIS_SOURCE_CHANGED`.                                                                                                                        |
-| `message`                                                                      | What happened, in words.                                                                                                                                                                                                                                                                                                                      |
-| `next`                                                                         | The command that gets findings for this run, or for a dry run the command that starts a live one. Null when no command can, as for a run whose participants left no evidence.                                                                                                                                                                 |
-| `analysisId`, `status`, `provider`, `model`, `completedAt`, `estimatedCostUsd` | The analysis version `analyze show` selects: the newest ready one, else the newest stale one. Null without one.                                                                                                                                                                                                                               |
-| `runPath`, `path`                                                              | The run directory and the version's `analysis.json`, relative to the project directory.                                                                                                                                                                                                                                                       |
-| `summary`, `limitations`                                                       | The analysis's own summary and limitations.                                                                                                                                                                                                                                                                                                   |
-| `findings[]`                                                                   | Highest priority first: `id`, `title`, `summary`, `impact` (`blocked_task`, `friction`, `recovery`, `uncertain`), `confidence` (`low`, `medium`, `high`), `recovery` (`recovered`, `not_observed`, `unknown`), `affected[]` (`streamId`, `label`), `exposedCount`, `evidence[]`, `nextStep` and `correction`.                                 |
-| `findings[].evidence[]`                                                        | Each cited item once: `id`, `streamId`, `kind`, `bases` (how the observations used it), `frame` (the latest retained capture's index from 0, null before any capture), `elapsedMs` (time since the first retained capture, not a video offset), `at` and `capture` (the file relative to the project directory, null for nonvisual evidence). |
-| `findings[].correction`                                                        | The latest `analyze correct` note on that finding version (`status`, `reason`, `replacementClaim`), or null.                                                                                                                                                                                                                                  |
-| `warnings`                                                                     | Load warnings for the selected version.                                                                                                                                                                                                                                                                                                       |
+| Field                                                                          | Meaning                                                                                                                                                                                                                                                                                                                                                                                 |
+| ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `schema`                                                                       | `humanish.analysis-findings.v1`.                                                                                                                                                                                                                                                                                                                                                        |
+| `runId`                                                                        | The run the view reads.                                                                                                                                                                                                                                                                                                                                                                 |
+| `state`                                                                        | `ready`, `stale`, `running`, `none`, `skipped`, `failed`, `dry_run` or `unavailable`. Only `ready` and `stale` carry findings.                                                                                                                                                                                                                                                          |
+| `reason`                                                                       | The stable code behind a state other than `ready`, or null: an automatic analysis reason such as `AUTOMATIC_ANALYSIS_KEY_MISSING`, a failed attempt's error code, or a load warning such as `ANALYSIS_SOURCE_CHANGED`.                                                                                                                                                                  |
+| `message`                                                                      | What happened, in words.                                                                                                                                                                                                                                                                                                                                                                |
+| `next`                                                                         | The command that gets findings for this run, or for a dry run the command that starts a live one. Null when no command can, as for a run whose participants left no evidence.                                                                                                                                                                                                           |
+| `analysisId`, `status`, `provider`, `model`, `completedAt`, `estimatedCostUsd` | The analysis version `analyze show` selects: the newest ready one, else the newest stale one. Null without one.                                                                                                                                                                                                                                                                         |
+| `runPath`, `path`                                                              | The run directory and the version's `analysis.json`, relative to the project directory.                                                                                                                                                                                                                                                                                                 |
+| `summary`, `limitations`                                                       | The analysis's own summary and limitations.                                                                                                                                                                                                                                                                                                                                             |
+| `findings[]`                                                                   | Highest priority first: `id`, `headline` and `experience` (null in analyses before `study-evidence-7`), `title`, `summary`, `impact` (`blocked_task`, `friction`, `recovery`, `uncertain`), `confidence` (`low`, `medium`, `high`), `recovery` (`recovered`, `not_observed`, `unknown`), `affected[]` (`streamId`, `label`), `exposedCount`, `evidence[]`, `nextStep` and `correction`. |
+| `findings[].evidence[]`                                                        | Each cited item once: `id`, `streamId`, `kind`, `bases` (how the observations used it), `frame` (the latest retained capture's index from 0, null before any capture), `elapsedMs` (time since the first retained capture, not a video offset), `at` and `capture` (the file relative to the project directory, null for nonvisual evidence).                                           |
+| `findings[].correction`                                                        | The latest `analyze correct` note on that finding version (`status`, `reason`, `replacementClaim`), or null. When `status` is `amended`, `replacementClaim` replaces the finding's headline and experience.                                                                                                                                                                             |
+| `designFindings`                                                               | Most severe first: `id`, `headline`, `screen`, `notice`, `whyItMatters`, `suggestion`, `severity` (`major`, `moderate`, `minor`), `confidence`, `seenBy[]` (`streamId`, `label`) and `evidence[]` (as `findings[].evidence[]`, without `bases`). Null without an analysis result, or for an analysis written before design findings.                                                    |
+| `warnings`                                                                     | Load warnings for the selected version.                                                                                                                                                                                                                                                                                                                                                 |
 
 The states without findings:
 
@@ -352,7 +413,10 @@ humanish feedback issue --run latest --analysis <id> --finding F1 --repo owner/r
 
 Corrections append against exact analysis and finding hashes. Confirming one
 version does not approve a later claim. Dismissed findings cannot become feedback
-drafts; amendments preserve the original and record the replacement. Feedback
+drafts; amendments preserve the original and record the replacement. A reason or replacement
+claim that matches a sensitive pattern is refused. When the correction is made inside the run's
+own invocation, one that holds a known transient value, as written or encoded, is refused too; a
+separate `analyze correct` command has no transient values to check against. Feedback
 drafts include source/version/evidence references and remain explicitly
 independent of participant-authored candidates. No command above posts to GitHub.
 Each analysis has room for 256 correction inventory entries, including interrupted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.111.4",
+  "version": "0.113.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",
@@ -76,6 +76,7 @@
     "tui:test": "pnpm --filter humanish-tui test",
     "release:dogfood": "node scripts/release-dogfood.mjs",
     "bench": "tsx bench/run.ts",
+    "arch:bench": "tsx scripts/arch-bench.ts",
     "browser-control:proof": "node scripts/browser-control-proof.mjs",
     "docs:generate": "tsx scripts/generate-cli-docs.ts",
     "docs:check": "tsx scripts/generate-cli-docs.ts --check && tsx scripts/check-doc-paths.ts && tsx scripts/check-doc-symbols.ts && tsx scripts/check-doc-comments.ts && tsx scripts/check-doc-study-fields.ts",

package/skills/humanish/SKILL.md

@@ -190,16 +190,6 @@ Legacy profiles without it retain medium defaults for missing patience and
 technical confidence. Avoid contradictory prose and traits; inspect the compiled
 brief with `humanish study show <study> --json` before running.
 
-For an autonomous participant study, use a computer-use/local-agent study and write
-its `mission` as a believable situation and desired outcome. Supply fixture facts
-needed to act, but do not supply selectors, click sequences, hidden success rules,
-expected defects or recovery tricks. For example: “Saturday's event needs two
-setup volunteers and one cleanup volunteer. See whether this app helps you
-organize the event and keep people informed.” Do not instruct a participant to
-find a specific UI control merely to make the study succeed. Allow discovery,
-recovery and stopping appropriate to the participant. Keep researcher criteria in
-`tasks[].success`, separate from participant-facing `tasks[].goal`.
-
 Scripted regression checks are a different use of scenarios. When the requested
 work is deterministic verification of a known path, a `browser.steps` manifest
 can drive it with explicit selectors and assertions. It does not establish
@@ -232,6 +222,27 @@ tokens into scenario files.
 
 ## Authoring Studies
 
+For an autonomous participant study, write `mission`, participant `instruction`
+and `tasks[].goal` as a believable situation and desired outcome. Supply fixture
+facts needed to act. Leave discovery, recovery and stopping to the participant.
+Keep researcher criteria in `tasks[].success`.
+
+| Bad: scripts the controls                                                              | Good: gives a situation                                                                                                                            |
+| -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Click "New event", type a title into the field, then press "Save" and open "Settings". | Saturday's event needs two setup volunteers and one cleanup volunteer. See whether this app helps you organize the event and keep people informed. |
+
+`humanish study check` and `humanish run` warn about step lists, chains of UI
+actions, quoted control labels, CSS selectors and URLs beyond the subject's entry
+point. They quote up to three matched lines and suggest a situation-style mission.
+The checks apply to computer-use and shared-world studies; scripted-browser and
+terminal studies and `tasks[].success` are excluded. These warnings never refuse
+a run, and the run records them in its bundle.
+
+Give each participant a persona with a short, fictional `background` describing
+their relevant experience and situation. A missing persona or background also
+warns. Use `humanish study show <study> --json` to see what the participant receives.
+Do not supply hidden success rules, expected defects or recovery tricks.
+
 Write reusable studies as `.yaml` study files (`humanish.study.v3`):
 
 ```yaml