humanish 0.120.1 → 0.122.0

package/dist/routes/computer-use/fanout-bundle.js

@@ -49,7 +49,25 @@ function fanoutSummary(args, facts) {
         return `${rerun}Dry run: ${people} would each use their own copy of ${subjectName(publicSafeAppUrlLabel(args.appUrl), args.aggregateSubject)}. No desktops were launched and $0 was spent.`;
     }
     const tasks = facts.tasks === undefined ? "" : ` Tasks: ${facts.tasks}.`;
-    return `${rerun}${people} took part, each in their own copy of the app: ${facts.outcomes}${gapsListClause(count - facts.passed, count)}.${tasks}`;
+    // A host suspension comes first: it may explain everything after it.
+    const host = args.hostSuspension === undefined ? "" : `${args.hostSuspension.summary} `;
+    return `${host}${rerun}${people} took part, each in their own copy of the app: ${facts.outcomes}${gapsListClause(count - facts.passed, count)}.${tasks}`;
+}
+/**
+ * The review's gaps: one line for the participants a host suspension likely failed, then a line
+ * for each other participant that did not pass.
+ */
+function fanoutGaps(args, judgment) {
+    const suspended = new Set(args.hostSuspension?.participantIds ?? []);
+    const others = judgment.participants.flatMap((participant, index) => participant.gapLine === undefined || suspended.has(args.specs[index].planned.id)
+        ? []
+        : [participant.gapLine]);
+    if (suspended.size === 0)
+        return others;
+    return [
+        `${[...suspended].join(", ")}: failed after the host was suspended, likely its effect. Each participant's record keeps its own error.`,
+        ...others,
+    ];
 }
 function fanoutReview(args, streams, judgment) {
     const { outcomes } = args;
@@ -91,7 +109,7 @@ function fanoutReview(args, streams, judgment) {
             ? ["Live fan-out session is still running."]
             : args.dryRun
                 ? ["Live fan-out session not yet run (dry run only)."]
-                : judgment.participants.flatMap((participant) => participant.gapLine === undefined ? [] : [participant.gapLine]),
+                : fanoutGaps(args, judgment),
     }, streams);
     return review;
 }
@@ -163,9 +181,8 @@ function fanoutFeedbackCandidates(args) {
 /**
  * Project N>1 fan-out participants into a humanish.run-bundle.v1 (the evidence schema is unchanged; this
  * is a new producer for the multi-stream shape). One sim + one stream per participant; per-participant
- * provenance/session events; a recorded `cua-lab.fanout.plan` event (and a `cua-lab.fanout.fail-fast`
- * event when a harness error skipped queued participants). N-ary verify/Observer already handle multiple
- * streams. A single-participant run without a rerun never reaches here: buildCuaRunBundle
+ * provenance/session events; a recorded `cua-lab.fanout.plan` event. N-ary verify/Observer already
+ * handle multiple streams. A single-participant run without a rerun never reaches here: buildCuaRunBundle
  * (bundle.ts) sends it to buildSingleParticipantBundle (single-bundle.ts).
  */
 export function buildCuaFanoutBundle(args) {
@@ -197,15 +214,6 @@ export function buildCuaFanoutBundle(args) {
         streams.push(records.stream);
         events.push(...records.events);
     });
-    if (args.failFastReason) {
-        events.push({
-            id: nextEventId("fanout-fail-fast"),
-            at: args.run.createdAt,
-            level: "warn",
-            type: "cua-lab.fanout.fail-fast",
-            message: `Fan-out fail-fast: ${args.failFastReason}. In-flight participants finished; queued participants were skipped (blocked); completed evidence is retained.`,
-        });
-    }
     const review = fanoutReview(args, streams, judgment);
     const anyRaw = (outcomes ?? []).some((outcome) => outcome.session?.trace.redaction.screenshots === "raw");
     const ranLive = (outcomes ?? []).some((outcome) => outcome.session !== undefined || outcome.sessionError !== undefined);

package/dist/routes/computer-use/live-phase.d.ts

@@ -38,6 +38,7 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
         rerun?: import("../../run/bundle.js").RunRerunLineage;
         observer?: import("../../index.js").ObserverResult;
         diagnostics?: import("./diagnostics.js").CuaDiagnostics;
+        hostSuspension?: import("../../run/host-suspension.js").HostSuspensionReading;
         warnings: string[];
         error?: {
             code: import("./types.js").CuaActorStudyErrorCode;
@@ -46,7 +47,6 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
         runId: string;
     };
     outcomes?: never;
-    failFastReason?: never;
     receiving?: never;
     receivingWarnings?: never;
     externalCommsWarnings?: never;
@@ -54,7 +54,6 @@ export declare function runStudyParticipants(setup: CuaRunSetup, participants: C
     result?: never;
     ok: true;
     outcomes: ParticipantRunOutcome[] | undefined;
-    failFastReason: string | undefined;
     receiving: CommsReceivingRun | undefined;
     receivingWarnings: string[];
     externalCommsWarnings: string[];

package/dist/routes/computer-use/live-phase.js

@@ -94,17 +94,16 @@ export async function runStudyParticipants(setup, participants) {
     }
     // Run the participants (dry-run runs none). In-process is always one.
     let outcomes;
-    let failFastReason;
     try {
         if (!dryRun)
-            ({ outcomes, failFastReason } = await runAllCuaParticipants(participantRuns, {
+            outcomes = await runAllCuaParticipants(participantRuns, {
                 ...deps,
                 // A session that throws returns no trace; the run still records that it started.
                 runSession: (options) => {
                     run.participantStarted();
                     return deps.runSession(options);
                 },
-            }, participantPlan, inProcess));
+            }, participantPlan, inProcess);
     }
     finally {
         try {
@@ -130,7 +129,6 @@ export async function runStudyParticipants(setup, participants) {
     return {
         ok: true,
         outcomes,
-        failFastReason,
         receiving,
         receivingWarnings,
         externalCommsWarnings,

package/dist/routes/computer-use/participant-deps.d.ts

@@ -3,7 +3,7 @@ import type { StudyDeps } from "../../study/study-deps.js";
 import type { LiveTraceFlush } from "./live-flush.js";
 import type { CuaParticipantDeps } from "./types.js";
 /** The deps a desktop route builds once per run. Each participant adds the app URL it opens. */
-export type DesktopParticipantDeps = Omit<CuaParticipantDeps, "signalProvisioned" | "appUrl" | "onObservedUrl">;
+export type DesktopParticipantDeps = Omit<CuaParticipantDeps, "signalReady" | "appUrl" | "onObservedUrl">;
 /** What every participant of a desktop run reads. Each route supplies all of it. */
 interface DesktopRunFacts {
     plan: Pick<ComputerUsePlan | SharedWorldPlan, "studyId" | "residual" | "caps" | "dryRun">;

package/dist/routes/computer-use/participant-deps.js

@@ -37,7 +37,9 @@ export function desktopParticipantDeps(run, overrides) {
         redactScreenshots: run.redactScreenshots,
         scrubKnownValues: run.scrubKnownValues,
         runSession: run.runSession,
-        now: seams.now ?? Date.now,
+        // The run's own clock unless a test sets another, so a participant's times and the run's host
+        // suspensions read one clock.
+        now: seams.now ?? seams.hostClock?.now ?? Date.now,
         onStream: run.onStream,
         reportSubjectPhase: run.reportSubjectPhase,
     };

package/dist/routes/computer-use/participant-execution.d.ts

@@ -12,27 +12,22 @@ export declare function makeParticipantWriteScreenshot(artifactRoot: PreparedOut
 export declare function runCuaParticipant(spec: DesktopParticipantRun, deps: CuaParticipantDeps): Promise<ParticipantRunOutcome>;
 /**
  * Run N>1 E2B participants on the study's schedule (runOnSchedule: each at its start offset, at
- * most `concurrency` at once), behind a pipeline gate (the first to start provisions before the
- * rest start) and session fail-fast on harness errors only (queued participants become `blocked`
- * with a pinned reason + a fail-fast event; mission verdicts never trip it). A gate failure or a
- * fail-fast ends every wait for a later start at once. Each participant tears down its own sandbox
- * by id; nothing here ever enumerates.
+ * most `concurrency` at once), behind the pipeline gate when the subject is set up in each sandbox.
+ * A harness error ends only its own participant: one desktop's stall or one provider failure does
+ * not predict the next participant's, so the schedule goes on. Only a closed gate ends every wait
+ * for a later start at once, and the participants it skips are `blocked` with its reason. Each
+ * participant tears down its own sandbox by id; nothing here ever enumerates.
  *
  * Exported for the total-runner tests: the injectable runner lets a test make one participant
  * throw (the exact class the guard exists for) without a live sandbox. Production always uses
  * the default.
  */
-export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalProvisioned">, concurrency: number, runParticipant?: typeof runCuaParticipant): Promise<{
-    outcomes: ParticipantRunOutcome[];
-    failFastReason?: string;
-}>;
+export declare function runCuaParticipants(runs: DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalReady">, concurrency: number, runParticipant?: typeof runCuaParticipant): Promise<ParticipantRunOutcome[]>;
 /** Project one participant outcome (or a dry-run contract spec) into the public CuaParticipantResult. */
 export declare function toParticipantResult(spec: DesktopParticipantRun, outcome: ParticipantRunOutcome | undefined, subject: RunSubjectProvenance, dryRun: boolean): CuaParticipantResult;
 /**
  * Run every participant of a live run. The in-process route drives its single participant in this
- * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency and may stop early.
+ * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency, and stops
+ * early only when the pipeline gate closes.
  */
-export declare function runAllCuaParticipants(runs: readonly DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalProvisioned">, participantPlan: CuaParticipantPlan, inProcess: boolean): Promise<{
-    outcomes: ParticipantRunOutcome[];
-    failFastReason: string | undefined;
-}>;
+export declare function runAllCuaParticipants(runs: readonly DesktopParticipantRun[], deps: Omit<CuaParticipantDeps, "signalReady">, participantPlan: CuaParticipantPlan, inProcess: boolean): Promise<ParticipantRunOutcome[]>;

package/dist/routes/computer-use/participant-execution.js

@@ -1,3 +1,4 @@
+import { scheduledParticipantDeps } from "./participant-runs.js";
 import { judgeParticipantRecords } from "../../run/judge.js";
 import { createE2BParticipantDesktop } from "./e2b-desktop/desktop.js";
 import { createInProcessDesktop } from "./in-process-desktop.js";
@@ -31,7 +32,7 @@ export function makeParticipantWriteScreenshot(artifactRoot, spec, screenshots)
         return rel;
     };
 }
-/** A blocked participant outcome (pipeline gate / fail-fast skipped it before it ran). */
+/** A blocked participant outcome: the pipeline gate or the study budget skipped it. */
 function skippedOutcome(spec, reason, arrival) {
     return {
         spec,
@@ -56,7 +57,6 @@ export async function runCuaParticipant(spec, deps) {
     // model turn only to stop at its first one, so it is skipped before its desktop exists.
     const crossed = deps.runBudget?.crossed();
     if (crossed !== undefined) {
-        deps.signalProvisioned?.(false);
         return skippedOutcome(spec, `skipped: study budget reached before this participant started: ${crossed}; no desktop was created`);
     }
     let model = {};
@@ -67,23 +67,13 @@ export async function runCuaParticipant(spec, deps) {
     let sessionError;
     let providerCleanupError;
     let providerPolicyError;
-    let provisioned = false;
-    let signaled = false;
-    const signal = (ok) => {
-        if (!signaled && deps.signalProvisioned) {
-            signaled = true;
-            deps.signalProvisioned(ok);
-        }
-    };
     const desktop = deps.createDesktop?.(spec, warnings, deps.artifactRoot) ??
         createE2BParticipantDesktop(spec, deps, warnings);
     try {
         await desktop.prepare();
         const ready = await desktop.openSession();
         model = await startParticipantModel(spec, deps, ready.executor);
-        // World is ready: release the pipeline gate so the remaining participants may start.
-        provisioned = true;
-        signal(true);
+        deps.signalReady?.();
         session = await deps.runSession(participantSessionOptions(spec, deps, ready, model.provider, writeScreenshot));
     }
     catch (error) {
@@ -102,18 +92,12 @@ export async function runCuaParticipant(spec, deps) {
                 : closed.refusal.startsWith("HUMANISH_CLAUDE_PARTICIPANT_")
                     ? `Claude Code's stream showed a call the participant may not make after its last turn (${closed.refusal}); the participant was stopped.`
                     : `Codex output after the participant's last request could not be checked against the item policy (${closed.refusal}).`));
-        try {
-            if (!provisioned)
-                signal(false);
-        }
-        finally {
-            await desktop.finalize({
-                failed: sessionError !== undefined ||
-                    providerCleanupError !== undefined ||
-                    providerPolicyError !== undefined ||
-                    session === undefined,
-            });
-        }
+        await desktop.finalize({
+            failed: sessionError !== undefined ||
+                providerCleanupError !== undefined ||
+                providerPolicyError !== undefined ||
+                session === undefined,
+        });
     }
     const { released, desktopFailure, ...desktopEvidence } = desktop.snapshot();
     // A desktop that died under the participant explains the failure better than the transport
@@ -127,8 +111,8 @@ export async function runCuaParticipant(spec, deps) {
     if (session)
         await recordParticipantTrace(spec, deps, session, warnings);
     const { noEngagement, selfReportedBlocker, reportedFriction } = judgeParticipantSession(session, deps, warnings);
-    // A provider-cleanup or provider-policy failure still trips fail-fast and counts in the
-    // participant summary's harness errors.
+    // A provider-cleanup or provider-policy failure counts in the participant summary's harness
+    // errors.
     const harnessError = sessionError !== undefined ||
         providerCleanupError !== undefined ||
         providerPolicyError !== undefined ||
@@ -147,57 +131,94 @@ export async function runCuaParticipant(spec, deps) {
         selfReportedBlocker,
         reportedFriction,
         harnessError,
+        endedAt: deps.now(),
+    };
+}
+/**
+ * Holds a fan-out's participants back until one of them is ready, when each sets up the subject in
+ * its own sandbox the same way (a clone or local tree built and served, a desktop CLI installed),
+ * so a subject that fails to set up fails once. The first participant to enter holds the gate and
+ * the others wait. Any participant that becomes ready opens it. A holder that never got a desktop
+ * learned nothing about the subject, so the next waiting participant holds it instead. A holder
+ * whose desktop came up and then failed before its session closes it, and `onClose` runs.
+ */
+function pipelineGate(open, onClose) {
+    let state = open ? "open" : "vacant";
+    let holder;
+    const waiting = [];
+    const settle = (turn) => {
+        for (const participant of waiting.splice(0))
+            participant.turn(turn);
+    };
+    return {
+        /** The participant that holds the gate, or held it when it closed. */
+        holder: () => holder,
+        enter(id) {
+            if (state === "open")
+                return Promise.resolve("start");
+            if (state === "closed")
+                return Promise.resolve("closed");
+            if (state === "vacant") {
+                state = "held";
+                holder = id;
+                return Promise.resolve("hold");
+            }
+            return new Promise((turn) => waiting.push({ id, turn }));
+        },
+        ready() {
+            if (state !== "held")
+                return;
+            state = "open";
+            settle("start");
+        },
+        failed(id, { handOver }) {
+            if (state !== "held" || holder !== id)
+                return;
+            if (handOver) {
+                const next = waiting.shift();
+                if (next === undefined)
+                    state = "vacant";
+                else {
+                    holder = next.id;
+                    next.turn("hold");
+                }
+                return;
+            }
+            state = "closed";
+            settle("closed");
+            onClose();
+        },
     };
 }
 /**
  * Run N>1 E2B participants on the study's schedule (runOnSchedule: each at its start offset, at
- * most `concurrency` at once), behind a pipeline gate (the first to start provisions before the
- * rest start) and session fail-fast on harness errors only (queued participants become `blocked`
- * with a pinned reason + a fail-fast event; mission verdicts never trip it). A gate failure or a
- * fail-fast ends every wait for a later start at once. Each participant tears down its own sandbox
- * by id; nothing here ever enumerates.
+ * most `concurrency` at once), behind the pipeline gate when the subject is set up in each sandbox.
+ * A harness error ends only its own participant: one desktop's stall or one provider failure does
+ * not predict the next participant's, so the schedule goes on. Only a closed gate ends every wait
+ * for a later start at once, and the participants it skips are `blocked` with its reason. Each
+ * participant tears down its own sandbox by id; nothing here ever enumerates.
  *
  * Exported for the total-runner tests: the injectable runner lets a test make one participant
  * throw (the exact class the guard exists for) without a live sandbox. Production always uses
  * the default.
  */
 export async function runCuaParticipants(runs, deps, concurrency, runParticipant = runCuaParticipant) {
-    const failFast = { tripped: false, reason: "" };
     const stopping = new AbortController();
-    let gateHolder = runs[0]?.planned.id ?? "lane-01";
-    let resolveGate;
-    let rejectGate;
-    const gate = new Promise((resolve, reject) => {
-        resolveGate = resolve;
-        rejectGate = () => {
-            reject(new Error("gate"));
-            stopping.abort();
-        };
-    });
-    // The gate is rejected on the first participant's provisioning failure; swallow the unhandled
-    // rejection if no later participant ever awaits it (concurrency could let the first finish
-    // alone).
-    gate.catch(() => undefined);
-    const outcomes = await runOnSchedule(runs, {
+    // An app-url subject is only opened, so one participant's start says nothing about another's.
+    const gate = pipelineGate(deps.subject.kind === "app-url", () => stopping.abort());
+    return runOnSchedule(runs, {
         startAfterMs: (spec) => spec.planned.startAfterMs,
         slots: concurrency,
         now: deps.now,
         signal: stopping.signal,
-    }, async (spec, _index, { order, scheduledAt }) => {
-        if (order === 0)
-            gateHolder = spec.planned.id;
-        if (order > 0) {
-            try {
-                await gate;
-            }
-            catch {
-                return skippedOutcome(spec, `skipped: participant ${gateHolder} failed to provision its world (pipeline gate)`, { scheduledAt });
-            }
-        }
-        if (failFast.tripped) {
-            return skippedOutcome(spec, `skipped: ${failFast.reason}`, { scheduledAt });
+    }, async (spec, _index, { scheduledAt }) => {
+        const id = spec.planned.id;
+        if ((await gate.enter(id)) === "closed") {
+            return skippedOutcome(spec, `skipped: participant ${gate.holder()} failed to provision its world (pipeline gate)`, { scheduledAt });
         }
         const arrival = { scheduledAt, startedAt: deps.now() };
+        let ready = false;
+        let threw = false;
         // The participant runner is total: every exit path returns a recorded outcome. Without this
         // guard, one participant's late throw (e.g. its trace write hitting ENOSPC after its own sandbox was
         // already torn down) rejected the whole map while sibling workers kept launching sandboxes
@@ -206,25 +227,15 @@ export async function runCuaParticipants(runs, deps, concurrency, runParticipant
         try {
             outcome = await runParticipant(spec, {
                 ...deps,
-                ...(order === 0
-                    ? {
-                        signalProvisioned: (ok) => {
-                            if (ok) {
-                                resolveGate?.();
-                            }
-                            else {
-                                rejectGate?.();
-                            }
-                        },
-                    }
-                    : {}),
+                ...scheduledParticipantDeps(spec.planned, deps, scheduledAt),
+                signalReady: () => {
+                    ready = true;
+                    gate.ready();
+                },
             });
         }
         catch (error) {
-            // The first participant may have thrown before signaling the provisioning gate; release the followers as
-            // blocked rather than leaving them awaiting a gate that will never settle.
-            if (order === 0)
-                rejectGate?.();
+            threw = true;
             const detail = redactText(toErrorMessage(error));
             outcome = {
                 spec,
@@ -239,20 +250,20 @@ export async function runCuaParticipants(runs, deps, concurrency, runParticipant
                 reportedFriction: false,
                 harnessError: true,
                 sessionError: `participant runner threw outside the session guard: ${detail}`,
+                endedAt: deps.now(),
             };
         }
-        if (outcome.harnessError && !failFast.tripped) {
-            failFast.tripped = true;
-            failFast.reason = `a prior participant (${outcome.spec.planned.id}) ended in a harness error (fail-fast)`;
-            stopping.abort();
-        }
+        // A participant that stopped before its session without a desktop says nothing about the
+        // subject, so the next participant starts first. A runner that threw is a harness defect: it
+        // closes the gate.
+        if (!ready)
+            gate.failed(id, { handOver: !threw && outcome.sandboxId === undefined });
         // A participant the study budget skipped never requested its desktop.
         return {
             ...outcome,
             arrival: outcome.skippedReason === undefined ? arrival : { scheduledAt },
         };
     });
-    return { outcomes, ...(failFast.tripped ? { failFastReason: failFast.reason } : {}) };
 }
 /** Project one participant outcome (or a dry-run contract spec) into the public CuaParticipantResult. */
 export function toParticipantResult(spec, outcome, subject, dryRun) {
@@ -347,19 +358,21 @@ export function toParticipantResult(spec, outcome, subject, dryRun) {
 }
 /**
  * Run every participant of a live run. The in-process route drives its single participant in this
- * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency and may stop early.
+ * process; one hosted participant runs alone; a fan-out runs at the plan's concurrency, and stops
+ * early only when the pipeline gate closes.
  */
 export async function runAllCuaParticipants(runs, deps, participantPlan, inProcess) {
+    // A participant that runs alone starts with the run.
+    const alone = { ...deps, ...scheduledParticipantDeps(runs[0].planned, deps, deps.now()) };
     if (inProcess) {
         // The caller's executor stands in for a desktop, and the shared runner drives the participant.
         const outcome = await runCuaParticipant(runs[0], {
-            ...deps,
+            ...alone,
             createDesktop: () => createInProcessDesktop(deps),
         });
-        return { outcomes: [outcome], failFastReason: undefined };
+        return [outcome];
     }
     if (runs.length === 1)
-        return { outcomes: [await runCuaParticipant(runs[0], deps)], failFastReason: undefined };
-    const ran = await runCuaParticipants([...runs], deps, participantPlan.concurrency);
-    return { outcomes: ran.outcomes, failFastReason: ran.failFastReason };
+        return [await runCuaParticipant(runs[0], alone)];
+    return runCuaParticipants([...runs], deps, participantPlan.concurrency);
 }

package/dist/routes/computer-use/participant-model.js

@@ -99,6 +99,7 @@ export function participantSessionOptions(spec, deps, ready, provider, writeScre
             : spec.instructions,
         persona: spec.persona,
         timeoutMs: deps.timeoutMs,
+        ...participantClock(spec.planned.limits.timeZone, deps),
         // The brain is either a keyed API client or a CLI the operator is already signed in to.
         // Everything below this line (loop, executor, trace, affordances) is identical either
         // way, which is what makes a local-agent run comparable to an API one.
@@ -305,3 +306,19 @@ export function makeCuaRunBudget(maxTotalUsd) {
         },
     };
 }
+/**
+ * The participant's clock: its time zone, and its scheduled end on the run's clock. A participant
+ * with an end runs its session on the run's clock, so the end and the schedule read one clock.
+ */
+function participantClock(timeZone, deps) {
+    const { scheduledEnd } = deps;
+    if (timeZone === undefined && scheduledEnd === undefined)
+        return {};
+    return {
+        clock: {
+            ...(timeZone === undefined ? {} : { timeZone }),
+            ...(scheduledEnd === undefined ? {} : { end: scheduledEnd }),
+        },
+        ...(scheduledEnd === undefined ? {} : { now: deps.now }),
+    };
+}

package/dist/routes/computer-use/participant-runs.d.ts

@@ -3,7 +3,8 @@ import { type StudyConfig } from "../../study/types.js";
 import { type ResolvedPersona } from "../../study/persona.js";
 import { type RunRerunLineage } from "../../run/bundle.js";
 import type { PreparedSelectedOutputDirectory } from "../../run/contained-output.js";
-import { type CuaActorStudyErrorCode, type CuaParticipantPlan, type CuaParticipantPlanEntry, type DesktopParticipantRun, type ParticipantRunsAndPlan } from "./types.js";
+import { type CuaActorStudyErrorCode, type CuaParticipantDeps, type CuaParticipantPlan, type CuaParticipantPlanEntry, type DesktopParticipantRun, type ParticipantRunsAndPlan } from "./types.js";
+import { type ParticipantWindow } from "../../study/arrivals.js";
 /**
  * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
  * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
@@ -16,6 +17,15 @@ export declare function defaultSessionTimeoutMs(config: StudyConfig, ceilingMs:
  *  git clone for an upload+extract, but the shared install/build/state/start/probe pipeline
  *  costs the same wall-clock room either way. */
 export declare function resolveParticipantSandboxMs(config: StudyConfig, ceilingMs: number): number;
+/**
+ * The deps one participant runs with once its start comes: its own session budget and sandbox
+ * deadline, and with a declared end, that end on the run's clock (`scheduledAt` is when it was
+ * due, from runOnSchedule).
+ */
+export declare function scheduledParticipantDeps(participant: ParticipantWindow, deps: {
+    readonly timeoutMs: number;
+    readonly sandboxMs: number;
+}, scheduledAt: number): Pick<CuaParticipantDeps, "timeoutMs" | "sandboxMs" | "scheduledEnd">;
 /**
  * The in-flight participant bound a study declares. Defaults to the participant count: every
  * declared participant runs at once, because a throttle nobody asked for silently turns "N actors

package/dist/routes/computer-use/participant-runs.js

@@ -18,7 +18,7 @@ import { composeParticipantInstructions, DEFAULT_MISSION } from "./participant-p
 import { resolveCuaRerunSelection } from "./rerun-selection.js";
 import { plural } from "../../run/text.js";
 import { formatDuration } from "../../run/projection.js";
-import { describeArrivals, planArrivals } from "../../study/arrivals.js";
+import { describeArrivals, participantSessionMs, planArrivals, scheduledEndAt, } from "../../study/arrivals.js";
 /**
  * The session budget of a study that declares no execution.timeoutMs. On a provisioned route it is
  * what the `ceilingMs` sandbox ceiling leaves after provisioning, seeding and the teardown buffer.
@@ -45,6 +45,30 @@ export function resolveParticipantSandboxMs(config, ceilingMs) {
         timeoutMs +
             sandboxHeadroomMs(provisionedRoute ? { seed: config.subject.state?.seed ?? [] } : undefined));
 }
+/**
+ * A participant's own session budget and sandbox deadline: the study's, or with a declared end its
+ * window plus room for the closing report (participantSessionMs), with the same setup and
+ * teardown headroom the study's sandbox has over its session.
+ */
+function participantWindow(participant, study) {
+    const timeoutMs = participantSessionMs(participant, study.sessionBudgetMs);
+    return { timeoutMs, sandboxMs: study.sandboxMs - study.sessionBudgetMs + timeoutMs };
+}
+/**
+ * The deps one participant runs with once its start comes: its own session budget and sandbox
+ * deadline, and with a declared end, that end on the run's clock (`scheduledAt` is when it was
+ * due, from runOnSchedule).
+ */
+export function scheduledParticipantDeps(participant, deps, scheduledAt) {
+    const end = scheduledEndAt(participant, scheduledAt);
+    return {
+        ...participantWindow(participant, {
+            sessionBudgetMs: deps.timeoutMs,
+            sandboxMs: deps.sandboxMs,
+        }),
+        ...(end === undefined ? {} : { scheduledEnd: end }),
+    };
+}
 /**
  * The in-flight participant bound a study declares. Defaults to the participant count: every
  * declared participant runs at once, because a throttle nobody asked for silently turns "N actors
@@ -114,10 +138,11 @@ export function participantRunsAndPlan(plan, opts = {}) {
     });
     const resolved = envLoweredConcurrency(plan.concurrency, participantCount, env);
     const concurrency = resolved.bound;
-    const { sessionBudgetMs, sandboxMs } = plan;
+    const { sessionBudgetMs } = plan;
     const schedule = resolved.envLoweredFrom === undefined
         ? plan.arrivals
-        : planArrivals(participants.map((participant) => participant.startAfterMs), { slots: concurrency, sessionMs: sessionBudgetMs });
+        : planArrivals(participants.map((participant) => participant.startAfterMs), { slots: concurrency, sessionMs: sessionBudgetMs }, participants.map((participant) => participantSessionMs(participant, sessionBudgetMs)));
+    const sandboxesMs = participants.reduce((sum, participant) => sum + participantWindow(participant, plan).sandboxMs, 0);
     const participantPlan = {
         strategy: CUA_FANOUT_STRATEGY,
         laneCount: participantCount,
@@ -127,7 +152,7 @@ export function participantRunsAndPlan(plan, opts = {}) {
             : { envLoweredConcurrencyFrom: resolved.envLoweredFrom }),
         waves: Math.ceil(participantCount / concurrency),
         perLaneSessionBudgetMs: sessionBudgetMs,
-        worstCaseSandboxMinutes: Math.round((participantCount * sandboxMs) / 60_000),
+        worstCaseSandboxMinutes: Math.round(sandboxesMs / 60_000),
         ...(schedule.declared ? { schedule } : {}),
         dryRun: plan.dryRun,
         lanes: runs.map((spec) => ({
@@ -158,6 +183,7 @@ export function participantRunsAndPlan(plan, opts = {}) {
             ...(spec.planned.startAfterMs === undefined
                 ? {}
                 : { startAfterMs: spec.planned.startAfterMs }),
+            ...(spec.planned.endAfterMs === undefined ? {} : { endAfterMs: spec.planned.endAfterMs }),
         })),
     };
     return { runs, participantPlan };
@@ -182,6 +208,7 @@ export function formatParticipantPlanEntry(entry) {
         entry.caseGroup ? `case=${entry.caseGroup}` : undefined,
         entry.reasoningEffort ? `effort=${entry.reasoningEffort}` : undefined,
         entry.startAfterMs === undefined ? undefined : `start=+${formatDuration(entry.startAfterMs)}`,
+        entry.endAfterMs === undefined ? undefined : `end=+${formatDuration(entry.endAfterMs)}`,
     ].filter((part) => part !== undefined);
     return `${entry.id}: persona=${entry.persona}${taxonomy.length > 0 ? ` ${taxonomy.join(" ")}` : ""} device=${entry.device} ${entry.resolution[0]}x${entry.resolution[1]} prompt#${entry.instructionDigest}${entry.targetDigest ? ` target#${entry.targetDigest}` : ""}`;
 }

package/dist/routes/computer-use/plan.js

@@ -9,7 +9,7 @@ import { studyUrlCredentialReason } from "../../study/url-credentials.js";
 import { subjectStateInvalidReason } from "../../study/parse/subject-state.js";
 import { brainOf, callerBrainOf, planCaps, desktopRequirements, planBase, provisionedSubject, } from "../../study/plan-base.js";
 import { computerUseParticipants, declaredTargets } from "../../study/plan-participants.js";
-import { planStarts } from "../../study/arrivals.js";
+import { planStarts, windowDeadlineRefusal } from "../../study/arrivals.js";
 import { computerUseParticipantCount, participantCountReason } from "../../study/routing.js";
 import { cloneTargetValidationReason, computerUseValidationReason, desktopMediaValidationReason, outputTokenLimitValidationReason, receivingEmailValidationReason, taskProtocolValidationReason, waitLimitValidationReason, } from "../../study/validation.js";
 import { desktopCliProductReason } from "../../study/composition-rules.js";
@@ -209,6 +209,13 @@ function startsOf(config, runner, limit, ceilingMs) {
     if (!atOnce.ok)
         return atOnce;
     const sessionMs = config.execution?.timeoutMs ?? defaultSessionTimeoutMs(config, ceilingMs);
+    // A participant with a declared end gets a sandbox sized from its own window.
+    if (runner.desktop === "e2b-desktop") {
+        const headroomMs = resolveParticipantSandboxMs(config, ceilingMs) - sessionMs;
+        const window = windowDeadlineRefusal(runner.participants, { sessionMs, headroomMs }, ceilingMs);
+        if (window !== undefined)
+            return { ok: false, message: window };
+    }
     const slots = { slots: atOnce.count, sessionMs };
     return {
         ok: true,