humanish 0.120.0 → 0.121.0

package/CHANGELOG.md

@@ -8,6 +8,33 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.121.0: One failed desktop fails alone, host sleep named as the cause (2026-10-10)
+
+humanish 0.121.0 keeps one participant's failed desktop from costing a whole hosted study, and
+names a host that slept mid-run as the likely cause of the failures after it. A computer-use study
+on an `app-url` subject no longer holds its participants behind the first one's desktop, and a
+participant that fails before its session no longer stops the participants queued behind it; a
+study whose subject is built in each sandbox still lets one participant set it up first, and the
+next one takes over when the first never got a desktop. When the machine running a study sleeps,
+the run records the suspension as a `host.suspended` event, and the run outcome, `humanish run`,
+the review and the `--json` result say the failures of participants running through it are
+likely its effect, while each participant's record keeps its own error. The review's participant
+line lists interruption causes in a fixed order.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.121.0)
+
+## 0.120.1: Analysis requests under Bun run past 5 minutes (2026-10-09)
+
+humanish 0.120.1 lets an analysis request from a Bun process run longer than 5 minutes. Under Bun,
+`undici` is Bun's built-in module, whose `fetch` ignores the analysis provider's dispatcher and
+ended each request after 300 seconds, so an analysis whose model took longer, as a 34-participant
+run's cohort requests did at 325 to 405 seconds, failed with `analysis_provider_network_error`.
+The provider now passes `timeout: false`, which Bun reads and Node's undici ignores, and the
+request's own `timeoutMs` ends it under either runtime. A `TimeoutError` from `fetch` is recorded
+as `provider_client_timeout`.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.120.1)
+
 ## 0.120.0: Analysis completes under Bun, runs past 16 participants print a bounded list, Observer counts participants by status (2026-10-09)
 
 humanish 0.120.0 completes an analysis run from a Bun process, prints a run of more than 16

package/dist/analysis/provider.d.ts

@@ -28,7 +28,7 @@ export interface AnalysisProviderResult {
     dispatched: boolean;
     /** Omitted preserves complete API-response accounting; account snapshots must state this. */
     usageComplete?: boolean;
-    errorCode: "invalid_request" | "provider_http_error" | "provider_network_error" | "invalid_response" | "provider_headers_timeout" | "provider_body_timeout" | "provider_connect_timeout" | "provider_connection_reset" | "provider_dns_error" | "codex_busy" | "codex_unavailable" | "codex_unsupported_version" | "codex_incompatible_release" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "response_too_large" | "output_incomplete" | "refusal" | "cancelled" | "timeout" | null;
+    errorCode: "invalid_request" | "provider_http_error" | "provider_network_error" | "invalid_response" | "provider_headers_timeout" | "provider_client_timeout" | "provider_body_timeout" | "provider_connect_timeout" | "provider_connection_reset" | "provider_dns_error" | "codex_busy" | "codex_unavailable" | "codex_unsupported_version" | "codex_incompatible_release" | "codex_unsupported_platform" | "codex_login_required" | "codex_unsupported_auth" | "codex_unsafe_configuration" | "codex_model_unavailable" | "codex_protocol_error" | "codex_tool_call" | "codex_process_failed" | "codex_cleanup_failed" | "response_too_large" | "output_incomplete" | "refusal" | "cancelled" | "timeout" | null;
     httpStatus?: number;
     /** Codex only: notification methods humanish does not know that carried no item, by count. */
     unknownNotifications?: Readonly<Record<string, number>>;
@@ -52,6 +52,11 @@ export type AnalysisFetch = (url: string, init: {
     headers: Record<string, string>;
     body: string;
     dispatcher: Dispatcher;
+    /**
+     * Bun's fetch ignores `dispatcher` and ends a request after 300 s unless this is false;
+     * Node's undici fetch ignores the field. The caller's timeoutMs governs either way.
+     */
+    timeout: false;
 }) => Promise<{
     ok: boolean;
     status: number;

package/dist/analysis/provider.js

@@ -34,6 +34,9 @@ function networkErrorCode(error) {
         const value = record(current);
         if (typeof value.code === "string" && Object.hasOwn(codes, value.code))
             return codes[value.code];
+        // Bun's fetch ends a request with a TimeoutError of its own, with no code.
+        if (value.name === "TimeoutError")
+            return "provider_client_timeout";
         current = value.cause;
     }
     return "provider_network_error";
@@ -177,6 +180,7 @@ export function createAnalysisProvider(options) {
                 headers: { Authorization: `Bearer ${options.apiKey}`, "Content-Type": "application/json" },
                 body,
                 dispatcher,
+                timeout: false,
             });
             if (!response.ok) {
                 // Never read provider error prose: it may echo evidence or credentials.

package/dist/cli/commands/study-format.js

@@ -1,10 +1,12 @@
 import { participantCaption } from "../../run/participant-caption.js";
 import { formatCuaDiagnostics, formatCuaStopCause } from "../../routes/computer-use/diagnostics.js";
 import { subjectName } from "../../run/subject-name.js";
+import { cli } from "../invocation.js";
 /**
  * A run's first lines: the command that ran, whether it was a dry run, how it ended, and its route.
  * `runOk` is the run's own ok, which automaticAnalysisEnvelope keeps when an analysis that did not
- * complete turns `ok` false. That run finished, and the line says so.
+ * complete turns `ok` false. That run finished, and the line says so. A host suspension follows,
+ * since it may explain every failure listed after it.
  */
 function runHeader(result, route) {
     const kind = result.dryRun === true ? "dry run" : result.dryRun === false ? "live run" : "run";
@@ -13,7 +15,24 @@ function runHeader(result, route) {
         : result.runOk === true
             ? "finished; the analysis did not complete"
             : "failed";
-    return [`humanish run ${result.studyId}: ${kind} ${ending}`, `route: ${route}`];
+    return [
+        `humanish run ${result.studyId}: ${kind} ${ending}`,
+        `route: ${route}`,
+        ...(result.hostSuspension === undefined ? [] : [result.hostSuspension.summary]),
+    ];
+}
+/**
+ * What to run after a host suspension failed participants: the rerun of those that did not pass,
+ * or the study again for a run with one participant.
+ */
+function suspensionNextStep(result, participants) {
+    if ((result.hostSuspension?.participantIds.length ?? 0) === 0)
+        return [];
+    return participants > 1
+        ? [
+            `Rerun the participants that did not pass: ${cli(`run ${result.studyId} --rerun-failed-from ${result.runId}`)}`,
+        ]
+        : [`Run it again: ${cli(`run ${result.studyId}`)}`];
 }
 /**
  * A run's human output: its lines on stdout and, when it failed with an error, that error on
@@ -167,8 +186,10 @@ export function formatScriptedStudyHuman(result, subject) {
 }
 /** `subject` is the study's declared subject, which names it when the result has no URL. */
 export function formatCuaStudyHuman(result, subject) {
+    const participants = result.lanes ?? [];
     return withError(result.error, [
         ...runHeader(result, "computer-use"),
+        ...suspensionNextStep(result, participants.length),
         `run: ${result.runId}`,
         `actor: ${result.actor}`,
         `subject: ${subjectLine(result.appUrl, subject)}`,
@@ -181,8 +202,8 @@ export function formatCuaStudyHuman(result, subject) {
             ? [`rerun: ${result.rerun.selectedLaneIds.join(", ")} from ${result.rerun.sourceRunId}`]
             : []),
         ...(result.diagnostics ? [`diagnostic: ${formatCuaDiagnostics(result.diagnostics)}`] : []),
-        ...participantLines(result.lanes ?? []),
-        ...(result.session && (result.lanes?.length ?? 0) <= 1
+        ...participantLines(participants),
+        ...(result.session && participants.length <= 1
             ? [
                 `session: ${participantStatus(result.session.status)} (${result.session.completionReason})${result.session.stopCause ? ` · ${formatCuaStopCause(result.session.stopCause)}` : ""} · ${result.session.reason}`,
                 `screenshots: ${result.session.screenshots}`,

package/dist/routes/computer-use/bundle.d.ts

@@ -2,6 +2,7 @@ import type { CuaActorDescriptor } from "../../actors/registry.js";
 import type { ComputerUsePlan } from "../../study/plan-types.js";
 import type { BundleRun, RunBundle, RunRerunLineage, RunSubjectProvenance } from "../../run/bundle.js";
 import { type Judgment } from "../../run/judge.js";
+import type { HostSuspensionReading } from "../../run/host-suspension.js";
 import type { CuaParticipantPlan, DesktopParticipantRun, ParticipantRunOutcome } from "./types.js";
 /** What every bundle of one run shares, in progress or final. */
 export interface CuaRunBundleBase {
@@ -35,6 +36,8 @@ interface CuaRunBundleState {
     subjects: RunSubjectProvenance[];
     aggregateSubject: RunSubjectProvenance;
     failFastReason?: string;
+    /** The final bundle's reading of the run's host suspensions. */
+    hostSuspension?: HostSuspensionReading;
     inProgress?: true;
 }
 /**

package/dist/routes/computer-use/bundle.js

@@ -61,6 +61,7 @@ export function buildCuaRunBundle(base, state) {
         participantPlan: base.participantPlan,
         ...(base.rerun === undefined ? {} : { rerun: base.rerun }),
         ...(state.failFastReason === undefined ? {} : { failFastReason: state.failFastReason }),
+        ...(state.hostSuspension === undefined ? {} : { hostSuspension: state.hostSuspension }),
         ...(base.publicRepo === undefined ? {} : { publicRepo: base.publicRepo }),
         ...inProgress,
     });
@@ -117,6 +118,7 @@ function singleParticipantArgs(base, state) {
             }),
         source: base.source,
         ...(state.inProgress === undefined ? {} : { inProgress: state.inProgress }),
+        ...(state.hostSuspension === undefined ? {} : { hostSuspension: state.hostSuspension }),
         subject: state.aggregateSubject,
         ...(desktopTemplate === undefined ? {} : { desktopTemplate }),
         ...(outcome?.desktopBrowser === undefined ? {} : { desktopBrowser: outcome.desktopBrowser }),

package/dist/routes/computer-use/fanout-bundle.js

@@ -49,7 +49,25 @@ function fanoutSummary(args, facts) {
         return `${rerun}Dry run: ${people} would each use their own copy of ${subjectName(publicSafeAppUrlLabel(args.appUrl), args.aggregateSubject)}. No desktops were launched and $0 was spent.`;
     }
     const tasks = facts.tasks === undefined ? "" : ` Tasks: ${facts.tasks}.`;
-    return `${rerun}${people} took part, each in their own copy of the app: ${facts.outcomes}${gapsListClause(count - facts.passed, count)}.${tasks}`;
+    // A host suspension comes first: it may explain everything after it.
+    const host = args.hostSuspension === undefined ? "" : `${args.hostSuspension.summary} `;
+    return `${host}${rerun}${people} took part, each in their own copy of the app: ${facts.outcomes}${gapsListClause(count - facts.passed, count)}.${tasks}`;
+}
+/**
+ * The review's gaps: one line for the participants a host suspension likely failed, then a line
+ * for each other participant that did not pass.
+ */
+function fanoutGaps(args, judgment) {
+    const suspended = new Set(args.hostSuspension?.participantIds ?? []);
+    const others = judgment.participants.flatMap((participant, index) => participant.gapLine === undefined || suspended.has(args.specs[index].planned.id)
+        ? []
+        : [participant.gapLine]);
+    if (suspended.size === 0)
+        return others;
+    return [
+        `${[...suspended].join(", ")}: failed after the host was suspended, likely its effect. Each participant's record keeps its own error.`,
+        ...others,
+    ];
 }
 function fanoutReview(args, streams, judgment) {
     const { outcomes } = args;
@@ -91,7 +109,7 @@ function fanoutReview(args, streams, judgment) {
             ? ["Live fan-out session is still running."]
             : args.dryRun
                 ? ["Live fan-out session not yet run (dry run only)."]
-                : judgment.participants.flatMap((participant) => participant.gapLine === undefined ? [] : [participant.gapLine]),
+                : fanoutGaps(args, judgment),
     }, streams);
     return review;
 }

package/dist/routes/computer-use/live-phase.d.ts

@@ -38,6 +38,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
         rerun?: import("../../run/bundle.js").RunRerunLineage;
         observer?: import("../../index.js").ObserverResult;
         diagnostics?: import("./diagnostics.js").CuaDiagnostics;
+        hostSuspension?: import("../../run/host-suspension.js").HostSuspensionReading;
         warnings: string[];
         error?: {
             code: import("./types.js").CuaActorStudyErrorCode;

package/dist/routes/computer-use/participant-deps.d.ts

@@ -3,7 +3,7 @@ import type { StudyDeps } from "../../study/study-deps.js";
 import type { LiveTraceFlush } from "./live-flush.js";
 import type { CuaParticipantDeps } from "./types.js";
 /** The deps a desktop route builds once per run. Each participant adds the app URL it opens. */
-export type DesktopParticipantDeps = Omit<CuaParticipantDeps, "signalProvisioned" | "appUrl" | "onObservedUrl">;
+export type DesktopParticipantDeps = Omit<CuaParticipantDeps, "signalReady" | "appUrl" | "onObservedUrl">;
 /** What every participant of a desktop run reads. Each route supplies all of it. */
 interface DesktopRunFacts {
     plan: Pick<ComputerUsePlan | SharedWorldPlan, "studyId" | "residual" | "caps" | "dryRun">;

package/dist/routes/computer-use/participant-deps.js

@@ -37,7 +37,9 @@ export function desktopParticipantDeps(run, overrides) {
         redactScreenshots: run.redactScreenshots,
         scrubKnownValues: run.scrubKnownValues,
         runSession: run.runSession,
-        now: seams.now ?? Date.now,
+        // The run's own clock unless a test sets another, so a participant's times and the run's host
+        // suspensions read one clock.
+        now: seams.now ?? seams.hostClock?.now ?? Date.now,
         onStream: run.onStream,
         reportSubjectPhase: run.reportSubjectPhase,
     };

package/dist/routes/computer-use/participant-execution.d.ts

@@ -12,17 +12,18 @@ export declare function makeParticipantWriteScreenshot(artifactRoot: PreparedOut
 export declare function runCuaParticipant(spec: DesktopParticipantRun, deps: CuaParticipantDeps): Promise<ParticipantRunOutcome>;
 /**
  * Run N>1 E2B participants on the study's schedule (runOnSchedule: each at its start offset, at
- * most `concurrency` at once), behind a pipeline gate (the first to start provisions before the
- * rest start) and session fail-fast on harness errors only (queued participants become `blocked`
- * with a pinned reason + a fail-fast event; mission verdicts never trip it). A gate failure or a
- * fail-fast ends every wait for a later start at once. Each participant tears down its own sandbox
- * by id; nothing here ever enumerates.
+ * most `concurrency` at once), behind the pipeline gate when the subject is set up in each sandbox,
+ * and session fail-fast on harness errors only (queued participants become `blocked` with a pinned
+ * reason + a fail-fast event; mission verdicts never trip it). A participant that stops before its
+ * session has failed on its own and trips no fail-fast. A closed gate or a fail-fast ends every
+ * wait for a later start at once. Each participant tears down its own sandbox by id; nothing here
+ * ever enumerates.
  *
  * Exported for the total-runner tests: the injectable runner lets a test make one participant
  * throw (the exact class the guard exists for) without a live sandbox. Production always uses
  * the default.
  */
-export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalProvisioned">, concurrency: number, runParticipant?: typeof runCuaParticipant): Promise<{
+export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalReady">, concurrency: number, runParticipant?: typeof runCuaParticipant): Promise<{
     outcomes: ParticipantRunOutcome[];
     failFastReason?: string;
 }>;
@@ -32,7 +33,7 @@ export declare function toParticipantResult(spec: DesktopParticipantRun, outcome
  * Run every participant of a live run. The in-process route drives its single participant in this
  * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency and may stop early.
  */
-export declare function runAllCuaParticipants(runs: readonly DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalProvisioned">, participantPlan: CuaParticipantPlan, inProcess: boolean): Promise<{
+export declare function runAllCuaParticipants(runs: readonly DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalReady">, participantPlan: CuaParticipantPlan, inProcess: boolean): Promise<{
     outcomes: ParticipantRunOutcome[];
     failFastReason: string | undefined;
 }>;

package/dist/routes/computer-use/participant-execution.js

@@ -56,7 +56,6 @@ export async function runCuaParticipant(spec, deps) {
     // model turn only to stop at its first one, so it is skipped before its desktop exists.
     const crossed = deps.runBudget?.crossed();
     if (crossed !== undefined) {
-        deps.signalProvisioned?.(false);
         return skippedOutcome(spec, `skipped: study budget reached before this participant started: ${crossed}; no desktop was created`);
     }
     let model = {};
@@ -67,23 +66,13 @@ export async function runCuaParticipant(spec, deps) {
     let sessionError;
     let providerCleanupError;
     let providerPolicyError;
-    let provisioned = false;
-    let signaled = false;
-    const signal = (ok) => {
-        if (!signaled && deps.signalProvisioned) {
-            signaled = true;
-            deps.signalProvisioned(ok);
-        }
-    };
     const desktop = deps.createDesktop?.(spec, warnings, deps.artifactRoot) ??
         createE2BParticipantDesktop(spec, deps, warnings);
     try {
         await desktop.prepare();
         const ready = await desktop.openSession();
         model = await startParticipantModel(spec, deps, ready.executor);
-        // World is ready: release the pipeline gate so the remaining participants may start.
-        provisioned = true;
-        signal(true);
+        deps.signalReady?.();
         session = await deps.runSession(participantSessionOptions(spec, deps, ready, model.provider, writeScreenshot));
     }
     catch (error) {
@@ -102,18 +91,12 @@ export async function runCuaParticipant(spec, deps) {
                 : closed.refusal.startsWith("HUMANISH_CLAUDE_PARTICIPANT_")
                     ? `Claude Code's stream showed a call the participant may not make after its last turn (${closed.refusal}); the participant was stopped.`
                     : `Codex output after the participant's last request could not be checked against the item policy (${closed.refusal}).`));
-        try {
-            if (!provisioned)
-                signal(false);
-        }
-        finally {
-            await desktop.finalize({
-                failed: sessionError !== undefined ||
-                    providerCleanupError !== undefined ||
-                    providerPolicyError !== undefined ||
-                    session === undefined,
-            });
-        }
+        await desktop.finalize({
+            failed: sessionError !== undefined ||
+                providerCleanupError !== undefined ||
+                providerPolicyError !== undefined ||
+                session === undefined,
+        });
     }
     const { released, desktopFailure, ...desktopEvidence } = desktop.snapshot();
     // A desktop that died under the participant explains the failure better than the transport
@@ -147,15 +130,73 @@ export async function runCuaParticipant(spec, deps) {
         selfReportedBlocker,
         reportedFriction,
         harnessError,
+        endedAt: deps.now(),
+    };
+}
+/**
+ * Holds a fan-out's participants back until one of them is ready, when each sets up the subject in
+ * its own sandbox the same way (a clone or local tree built and served, a desktop CLI installed),
+ * so a subject that fails to set up fails once. The first participant to enter holds the gate and
+ * the others wait. Any participant that becomes ready opens it. A holder that never got a desktop
+ * learned nothing about the subject, so the next waiting participant holds it instead. A holder
+ * whose desktop came up and then failed before its session closes it, and `onClose` runs.
+ */
+function pipelineGate(open, onClose) {
+    let state = open ? "open" : "vacant";
+    let holder;
+    const waiting = [];
+    const settle = (turn) => {
+        for (const participant of waiting.splice(0))
+            participant.turn(turn);
+    };
+    return {
+        /** The participant that holds the gate, or held it when it closed. */
+        holder: () => holder,
+        enter(id) {
+            if (state === "open")
+                return Promise.resolve("start");
+            if (state === "closed")
+                return Promise.resolve("closed");
+            if (state === "vacant") {
+                state = "held";
+                holder = id;
+                return Promise.resolve("hold");
+            }
+            return new Promise((turn) => waiting.push({ id, turn }));
+        },
+        ready() {
+            if (state !== "held")
+                return;
+            state = "open";
+            settle("start");
+        },
+        failed(id, { handOver }) {
+            if (state !== "held" || holder !== id)
+                return;
+            if (handOver) {
+                const next = waiting.shift();
+                if (next === undefined)
+                    state = "vacant";
+                else {
+                    holder = next.id;
+                    next.turn("hold");
+                }
+                return;
+            }
+            state = "closed";
+            settle("closed");
+            onClose();
+        },
     };
 }
 /**
  * Run N>1 E2B participants on the study's schedule (runOnSchedule: each at its start offset, at
- * most `concurrency` at once), behind a pipeline gate (the first to start provisions before the
- * rest start) and session fail-fast on harness errors only (queued participants become `blocked`
- * with a pinned reason + a fail-fast event; mission verdicts never trip it). A gate failure or a
- * fail-fast ends every wait for a later start at once. Each participant tears down its own sandbox
- * by id; nothing here ever enumerates.
+ * most `concurrency` at once), behind the pipeline gate when the subject is set up in each sandbox,
+ * and session fail-fast on harness errors only (queued participants become `blocked` with a pinned
+ * reason + a fail-fast event; mission verdicts never trip it). A participant that stops before its
+ * session has failed on its own and trips no fail-fast. A closed gate or a fail-fast ends every
+ * wait for a later start at once. Each participant tears down its own sandbox by id; nothing here
+ * ever enumerates.
  *
  * Exported for the total-runner tests: the injectable runner lets a test make one participant
  * throw (the exact class the guard exists for) without a live sandbox. Production always uses
@@ -164,40 +205,26 @@ export async function runCuaParticipant(spec, deps) {
 export async function runCuaParticipants(runs, deps, concurrency, runParticipant = runCuaParticipant) {
     const failFast = { tripped: false, reason: "" };
     const stopping = new AbortController();
-    let gateHolder = runs[0]?.planned.id ?? "lane-01";
-    let resolveGate;
-    let rejectGate;
-    const gate = new Promise((resolve, reject) => {
-        resolveGate = resolve;
-        rejectGate = () => {
-            reject(new Error("gate"));
-            stopping.abort();
-        };
-    });
-    // The gate is rejected on the first participant's provisioning failure; swallow the unhandled
-    // rejection if no later participant ever awaits it (concurrency could let the first finish
-    // alone).
-    gate.catch(() => undefined);
+    // An app-url subject is only opened, so one participant's start says nothing about another's.
+    const gate = pipelineGate(deps.subject.kind === "app-url", () => stopping.abort());
     const outcomes = await runOnSchedule(runs, {
         startAfterMs: (spec) => spec.planned.startAfterMs,
         slots: concurrency,
         now: deps.now,
         signal: stopping.signal,
-    }, async (spec, _index, { order, scheduledAt }) => {
-        if (order === 0)
-            gateHolder = spec.planned.id;
-        if (order > 0) {
-            try {
-                await gate;
-            }
-            catch {
-                return skippedOutcome(spec, `skipped: participant ${gateHolder} failed to provision its world (pipeline gate)`, { scheduledAt });
-            }
-        }
+    }, async (spec, _index, { scheduledAt }) => {
         if (failFast.tripped) {
             return skippedOutcome(spec, `skipped: ${failFast.reason}`, { scheduledAt });
         }
+        // A participant trips fail-fast only after the gate opened, or as it closes the gate, so no
+        // participant is still waiting at the gate when fail-fast skips the rest.
+        const id = spec.planned.id;
+        if ((await gate.enter(id)) === "closed") {
+            return skippedOutcome(spec, `skipped: participant ${gate.holder()} failed to provision its world (pipeline gate)`, { scheduledAt });
+        }
         const arrival = { scheduledAt, startedAt: deps.now() };
+        let ready = false;
+        let threw = false;
         // The participant runner is total: every exit path returns a recorded outcome. Without this
         // guard, one participant's late throw (e.g. its trace write hitting ENOSPC after its own sandbox was
         // already torn down) rejected the whole map while sibling workers kept launching sandboxes
@@ -206,25 +233,14 @@ export async function runCuaParticipants(runs, deps, concurrency, runParticipant
         try {
             outcome = await runParticipant(spec, {
                 ...deps,
-                ...(order === 0
-                    ? {
-                        signalProvisioned: (ok) => {
-                            if (ok) {
-                                resolveGate?.();
-                            }
-                            else {
-                                rejectGate?.();
-                            }
-                        },
-                    }
-                    : {}),
+                signalReady: () => {
+                    ready = true;
+                    gate.ready();
+                },
             });
         }
         catch (error) {
-            // The first participant may have thrown before signaling the provisioning gate; release the followers as
-            // blocked rather than leaving them awaiting a gate that will never settle.
-            if (order === 0)
-                rejectGate?.();
+            threw = true;
             const detail = redactText(toErrorMessage(error));
             outcome = {
                 spec,
@@ -239,9 +255,15 @@ export async function runCuaParticipants(runs, deps, concurrency, runParticipant
                 reportedFriction: false,
                 harnessError: true,
                 sessionError: `participant runner threw outside the session guard: ${detail}`,
+                endedAt: deps.now(),
             };
         }
-        if (outcome.harnessError && !failFast.tripped) {
+        // A participant that stopped before its session failed on its own and trips no fail-fast.
+        // Without a desktop it says nothing about the subject, so the next participant starts first.
+        // A runner that threw is a harness defect: it closes the gate and trips fail-fast.
+        if (!ready)
+            gate.failed(id, { handOver: !threw && outcome.sandboxId === undefined });
+        if (outcome.harnessError && (ready || threw) && !failFast.tripped) {
             failFast.tripped = true;
             failFast.reason = `a prior participant (${outcome.spec.planned.id}) ended in a harness error (fail-fast)`;
             stopping.abort();