humanish 0.134.0 → 0.136.0

package/dist/run-study.js

@@ -34,9 +34,9 @@ export async function runStudyWith(config, options, deps = {}) {
 /**
  * The package's study runner (`src/index.ts`): runStudyWith with the public options only. A
  * config that skipped parseStudy is checked first (libraryConfigRefusal): a humanish.lab.v2 config
- * or one with a humanish 0.110 field, no `actor`, or a `route` the config does not take. That, or a
- * field RunStudyOptions no longer has, is refused in the route's own result envelope before
- * anything runs.
+ * or one with a humanish 0.110 field, no `actor`, a `route` the config does not take, or an
+ * `actor.model` verify would flag. That, or a field RunStudyOptions no longer has, is refused in the
+ * route's own result envelope before anything runs.
  */
 export async function runStudy(config, options) {
     const rejected = libraryConfigRefusal(config);

package/dist/study/bundle-estimate.d.ts

@@ -1,6 +1,9 @@
 import type { DwellWindow } from "../actors/stop-conditions.js";
 import type { ParticipantSchedule } from "./arrivals.js";
-/** One participant as the plan has it: its schedule, its dwell window and its mission. */
+/**
+ * One participant as the plan has it: its schedule, its dwell window, its mission and instruction,
+ * and its task goals.
+ */
 export interface EstimatedParticipant {
     readonly schedule: ParticipantSchedule;
     readonly limits: {
@@ -8,16 +11,28 @@ export interface EstimatedParticipant {
     };
     readonly assignment: {
         readonly mission?: string;
+        readonly focus?: string;
     };
+    readonly tasks?: readonly {
+        readonly goal: string;
+    }[];
 }
+/**
+ * The study fields run.json copies into each participant's stream, and the advice to shorten each.
+ * The plan does not keep which form declared the participants, so the advice names both paths.
+ */
+declare const COPIED_FIELDS: Readonly<{
+    mission: "shorten the mission (actor.mission)";
+    focus: "shorten the participants' instructions (participants.instruction or participants[].instruction)";
+    tasks: "shorten the task goals (actor.tasks[].goal)";
+}>;
+type CopiedField = keyof typeof COPIED_FIELDS;
 /** A run's estimated bundle, and the scan's limit for its participants. */
 export interface BundleEstimate {
     /** run.json, which analysis reads whole. */
     readonly runFileBytes: number;
     /** The largest participant trace file, which analysis also reads whole. */
     readonly largestTraceBytes: number;
-    /** Every participant's trace file together, whose items the Observer page joins in one string. */
-    readonly tracesBytes: number;
     /** observer/index.html, which verify reads whole. */
     readonly observerPageBytes: number;
     /** Every file, screenshots included. */
@@ -36,6 +51,8 @@ export interface BundleEstimate {
         readonly open: number;
         readonly openMs: number;
         readonly dwell: boolean;
+        /** The copied field with the most bytes over all participants, when one has any. */
+        readonly largestField?: CopiedField;
     };
 }
 /**
@@ -53,3 +70,4 @@ export declare function estimateBundle(participants: readonly EstimatedParticipa
 export declare function bundleLimitReason(estimate: BundleEstimate): string | undefined;
 /** The estimate beside the limits, for `study check`. */
 export declare function describeBundle(estimate: BundleEstimate): string;
+export {};

package/dist/study/bundle-estimate.js

@@ -7,22 +7,27 @@
 // observer/index.html carries every participant's items gzipped, so with busy participants it
 // passes verify's 32 MiB long before run.json passes analysis's 16 MiB: at these rates, 20
 // participants working 8 hours. From run bundle v4 run.json grows by participant, not by model
-// request: each participant's per-request lists are only in its trace. run.json holds the mission
-// once for the run, once in each participant's stream and once more in the feedback candidate of
-// each participant that reports friction or stops. The mission is not capped, and the estimate
-// counts that last copy for every participant, so it warns at 100 participants with a mission of
-// 75,238 bytes. On 2026-10-13 the longest mission on the live computer-use runs kept on the
-// maintainer's machine was 807 characters.
+// request: each participant's per-request lists are only in its trace. run.json holds each
+// participant's text, its mission, its instruction and its task goals, in its stream and again in
+// the feedback candidate of a participant that reports friction or stops, and the first
+// participant's once more in the scenario goal. A synthetic live run of 3 participants that all
+// reported friction held their instructions 3, 2 and 2 times, and the mission and each of 2 task
+// goals 7 times. None of the three fields is capped, and the estimate counts the feedback
+// candidate's copy for every participant, so it warns at 100 participants with 75,238 bytes of
+// text each. On 2026-10-13 the longest mission on the live computer-use runs kept on the
+// maintainer's machine was 807 characters. On 2026-10-14 the longest instruction on the 170 live
+// runs kept there was 4,061 characters, and none declared task goals.
 // observer-data.json leaves the lists out too and was 0.94 to 1.12 of run.json's size on the live
 // runs measured, so it passes 32 MiB only after run.json passes 16 MiB, and the estimate does not
 // check it.
-// The Observer page and the Observer server join every participant's items in one string before
-// gzip. A bundle export renders the Observer page, so it fails there too once --max-bytes is
-// raised past its 25 MiB default, which refuses such a run first. Writing run.json joins none: the
-// sandbox id scrub (publicSandboxView) works one participant at a time. V8's longest string is
-// 536,870,888 characters on Node 24. A trace file's bytes are at least the characters of its
-// items as compact JSON, so the estimate compares the traces' bytes and may warn a little early.
-import { constants } from "node:buffer";
+// A page past 32 MiB grades the run local_only. humanish export then needs --local-only, and a
+// bundle export fails even with it, since its copy must verify as share_ready.
+// The Observer feed, verify, analysis and the run.json writer each hold one participant's items in
+// a string at a time. The page holds all of them gzipped in base64, about 0.18 characters for each
+// trace byte, so it reaches V8's longest string, 536,870,888 characters, near 3 GB of traces.
+// humanish observe on 25 participants with 30 MiB traces wrote a 138 MiB page at a peak of
+// 3.8 GiB, so memory may run out first. Neither limit was measured past that run, and the estimate
+// checks neither.
 import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
 import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { formatDuration } from "../run/projection.js";
@@ -82,10 +87,11 @@ const RATES = Object.freeze({
     /**
      * The page's compact copy of observer-data.json, as a share of run.json before the mission: 0.71
      * to 0.84 on the live runs written as v4, where neither carries the per-request lists. The page
-     * holds the mission at its full size once for the run and once for each participant: dry runs of
-     * 1 and 4 participants grew the page by 2 and 5 copies, as run.json grew, and a 0.128.0 run of 2
-     * participants with 2 feedback candidates held 5 copies in run.json and 3 on the page. An
-     * analysis adds each participant's assignment, cut to 8,000 bytes.
+     * holds each participant's text at its full size once, and the first participant's once more for
+     * the run: dry runs of 1 and 4 participants grew the page by 2 and 5 copies of the mission, as
+     * run.json grew, and a 0.128.0 run of 2 participants with 2 feedback candidates held 5 copies in
+     * run.json and 3 on the page. The synthetic run of 3 held their instructions 2, 1 and 1 times on
+     * the page. An analysis adds each participant's assignment, cut to 8,000 bytes.
      */
     observerPageDataShare: 0.85,
     /**
@@ -106,6 +112,15 @@ const RATES = Object.freeze({
     participantEntries: 3,
 });
 const MIB = 1024 * 1024;
+/**
+ * The study fields run.json copies into each participant's stream, and the advice to shorten each.
+ * The plan does not keep which form declared the participants, so the advice names both paths.
+ */
+const COPIED_FIELDS = Object.freeze({
+    mission: "shorten the mission (actor.mission)",
+    focus: "shorten the participants' instructions (participants.instruction or participants[].instruction)",
+    tasks: "shorten the task goals (actor.tasks[].goal)",
+});
 /**
  * The bundle a live run of `participants` leaves, each in its session of `sessionMs` unless it
  * declares an end or a cap. A participant with an end works its whole window; one without ends
@@ -118,13 +133,14 @@ export function estimateBundle(participants, sessionMs) {
     let frames = 0;
     let traces = 0;
     let largestTrace = 0;
-    let missionBytes = 0;
-    let longestMission = 0;
+    // The bytes of each copied field over all participants, and the longest participant's text.
+    const fieldBytes = { mission: 0, focus: 0, tasks: 0 };
+    let longestText = 0;
     let longestWindowMs = 0;
     // The longest any participant without an end is counted, for the messages.
     let openMs = Math.min(sessionMs, RATES.openSessionMs);
     let scheduled = 0;
-    for (const { schedule, limits, assignment } of participants) {
+    for (const { schedule, limits, assignment, tasks = [] } of participants) {
         const { end } = schedule;
         const budgetMs = end?.windowMs ?? sessionMs;
         let countedMs;
@@ -145,31 +161,36 @@ export function estimateBundle(participants, sessionMs) {
         frames += ownFrames;
         traces += trace;
         largestTrace = Math.max(largestTrace, trace);
-        // The mission's bytes as run.json stores them, a JSON string without its quotes.
-        const mission = assignment.mission === undefined
-            ? 0
-            : Buffer.byteLength(JSON.stringify(assignment.mission)) - 2;
-        missionBytes += mission;
-        longestMission = Math.max(longestMission, mission);
+        const mission = storedBytes(assignment.mission);
+        const focus = storedBytes(assignment.focus);
+        const goals = tasks.reduce((sum, task) => sum + storedBytes(task.goal), 0);
+        fieldBytes.mission += mission;
+        fieldBytes.focus += focus;
+        fieldBytes.tasks += goals;
+        longestText = Math.max(longestText, mission + focus + goals);
     }
+    const textBytes = fieldBytes.mission + fieldBytes.focus + fieldBytes.tasks;
+    // Sorting is stable, so of fields with equal bytes the first declared is named.
+    const [largestField] = Object.keys(fieldBytes)
+        .filter((field) => fieldBytes[field] > 0)
+        .sort((a, b) => fieldBytes[b] - fieldBytes[a]);
     const count = participants.length;
     const dataBytes = RATES.runBytes + count * RATES.participantBytes;
-    // run.json holds the mission in the run's scenario goal, in each participant's stream and in the
-    // feedback candidate of each participant that reports friction or stops, counted for every
-    // participant. The rates were fit on runs with short missions, so a short mission is counted
-    // twice.
-    const runFileBytes = dataBytes + longestMission + 2 * missionBytes;
+    // run.json holds each participant's text in its stream and in its feedback candidate if it
+    // reports friction or stops, counted for every participant, and the first participant's in the
+    // run's scenario goal, counted at the longest. The rates were fit on runs with short texts, so a
+    // short text is counted twice.
+    const runFileBytes = dataBytes + longestText + 2 * textBytes;
     const screenshots = count + turns + frames;
     // The page holds no feedback candidate's copy.
     const observerPageBytes = Math.round(RATES.observerAppBytes +
         RATES.observerPageDataShare * dataBytes +
-        longestMission +
-        missionBytes +
+        longestText +
+        textBytes +
         RATES.observerPageItemsShare * traces);
     return {
         runFileBytes,
         largestTraceBytes: largestTrace,
-        tracesBytes: traces,
         observerPageBytes,
         // observer-data.json is about run.json's size.
         totalBytes: observerPageBytes + screenshots * RATES.screenshotBytes + traces + 2 * runFileBytes,
@@ -182,9 +203,14 @@ export function estimateBundle(participants, sessionMs) {
             open: count - scheduled,
             openMs,
             dwell: frames > 0,
+            ...(largestField === undefined ? {} : { largestField }),
         },
     };
 }
+/** A text's bytes as run.json stores it, a JSON string without its quotes. */
+function storedBytes(text) {
+    return text === undefined ? 0 : Buffer.byteLength(JSON.stringify(text)) - 2;
+}
 /**
  * The warning for a run whose estimate passes a limit, or undefined: each limit it passes, what the
  * estimate counted, and what to change.
@@ -192,12 +218,11 @@ export function estimateBundle(participants, sessionMs) {
 export function bundleLimitReason(estimate) {
     const runFile = estimate.runFileBytes > EVIDENCE_LIMITS.sourceBytes;
     const page = estimate.observerPageBytes > RUN_ARTIFACT_MAX_BYTES;
-    const joined = estimate.tracesBytes > constants.MAX_STRING_LENGTH;
     const entries = estimate.entries > estimate.entryLimit;
     const passed = [
         ...(runFile
             ? [
-                `This study's run.json may grow to about ${mib(estimate.runFileBytes)}, past the ${mib(EVIDENCE_LIMITS.sourceBytes)} analysis reads. It holds the mission once for the run, once in each participant's stream and once more for each participant that reports friction or stops, and the estimate counts the last copy for every participant.`,
+                `This study's run.json may grow to about ${mib(estimate.runFileBytes)}, past the ${mib(EVIDENCE_LIMITS.sourceBytes)} analysis reads. It holds the mission, the task goals and each participant's instruction in that participant's stream, and again in the feedback candidate of each participant that reports friction or stops. It holds the first participant's mission, instruction and task goals once more for the run, and the estimate counts a feedback candidate for every participant.`,
             ]
             : []),
         ...(estimate.largestTraceBytes > RUN_ARTIFACT_MAX_BYTES
@@ -207,12 +232,7 @@ export function bundleLimitReason(estimate) {
             : []),
         ...(page
             ? [
-                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file.`,
-            ]
-            : []),
-        ...(joined
-            ? [
-                `All participants' traces together may grow to about ${mib(estimate.tracesBytes)}, past the ${mib(constants.MAX_STRING_LENGTH)} that fits in one string. The Observer page puts all their items in one string, so the page would not build. A bundle export allowed past its 25 MiB default renders that page, so it would fail too.`,
+                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file, so verify would grade the run local_only: humanish export would refuse it without --local-only, and a bundle export would fail.`,
             ]
             : []),
         ...(entries
@@ -223,7 +243,7 @@ export function bundleLimitReason(estimate) {
     ];
     if (passed.length === 0)
         return undefined;
-    const { scheduled, longestWindowMs, open, openMs, dwell } = estimate.basis;
+    const { scheduled, longestWindowMs, open, openMs, dwell, largestField } = estimate.basis;
     const counted = [
         ...(scheduled > 0
             ? [
@@ -239,10 +259,10 @@ export function bundleLimitReason(estimate) {
     const changes = [
         ...(scheduled > 0 ? ["shorten the longest windows (participants[].endAfterMs)"] : []),
         ...(dwell ? ["shorten the dwell window (dwell.ms) or capture less often (dwell.everyMs)"] : []),
-        ...(runFile ? ["shorten the mission (actor.mission)"] : []),
+        ...(runFile && largestField !== undefined ? [COPIED_FIELDS[largestField]] : []),
     ];
     // A trace is one participant's, so splitting the study helps only the run's own files.
-    if (runFile || page || joined || entries || changes.length === 0)
+    if (runFile || page || entries || changes.length === 0)
         changes.push("split the participants across studies");
     const advice = changes.length < 2
         ? changes.join("")

package/dist/study/config.d.ts

@@ -30,9 +30,10 @@ interface ConfigRefusal {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export declare function libraryConfigRefusal(config: StudyConfig): ConfigRefusal | undefined;
 export {};

package/dist/study/config.js

@@ -30,7 +30,7 @@ import { isLocalBrowserStudy, localBrowserDefaults, localBrowserUnsupportedReaso
 import { isRecord } from "../run/type-guards.js";
 import { compositionReason } from "./composition-rules.js";
 import { V2_SCHEMA, V2_UNSUPPORTED_MESSAGE, v2FieldMoves } from "./migrate/v2.js";
-import { parseActorFields, parseActorType, parseParticipantEntries } from "./parse/actors.js";
+import { actorModelReason, parseActorFields, parseActorType, parseParticipantEntries, } from "./parse/actors.js";
 import { parseComms, recipientParticipantId } from "./parse/comms.js";
 import { parseCaps, parseDefaults, parseExecution, parsePolicies, parseReview, } from "./parse/execution.js";
 import { ACTOR_REQUIRED, readStudyFront, routeNameReason, } from "./parse/front.js";
@@ -96,9 +96,10 @@ function routeMismatchReason(config) {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export function libraryConfigRefusal(config) {
     const raw = config;
@@ -114,7 +115,9 @@ export function libraryConfigRefusal(config) {
         };
     if (!isRecord(raw.actor))
         return { code: "HUMANISH_STUDY_INVALID", message: ACTOR_REQUIRED };
-    const message = routeNameReason(raw.route) ?? routeMismatchReason(config);
+    const message = routeNameReason(raw.route) ??
+        routeMismatchReason(config) ??
+        actorModelReason(raw.actor.model, "actor");
     return message === undefined ? undefined : { code: "HUMANISH_STUDY_INVALID", message };
 }
 // Each section in a fixed order, so a file with more than one error always reports the same one

package/dist/study/parse/actors.d.ts

@@ -6,6 +6,12 @@ export declare function parseActorType(entry: Record<string, unknown>, path: str
     ok: true;
     value: string;
 } | StudyParseFailure;
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export declare function actorModelReason(raw: unknown, path: string): string | undefined;
 /** An actor's keys other than `type`. */
 type ActorFields = Omit<StudyActor, "type">;
 /**

package/dist/study/parse/actors.js

@@ -51,6 +51,17 @@ function parsePersonaId(raw, path) {
     }
     return { ok: true, value: persona };
 }
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export function actorModelReason(raw, path) {
+    const model = str(raw);
+    if (model === undefined || !scanEncodedText(model).sensitive)
+        return undefined;
+    return `\`${path}.model\` looks like a secret or a local path, and the run records it. Set the model id your provider lists, or leave \`${path}.model\` out to use the default.`;
+}
 /**
  * Every actor key other than `type`. The parser reads them after the participant entries, so a file
  * with errors in both reports the entry first.
@@ -65,6 +76,9 @@ export function parseActorFields(entry, path) {
     const mission = str(entry.mission);
     if (mission)
         actor.mission = mission;
+    const modelReason = actorModelReason(entry.model, path);
+    if (modelReason)
+        return invalid(modelReason);
     const model = str(entry.model);
     if (model)
         actor.model = model;

package/dist/study/parse/subject-state.js

@@ -1,7 +1,7 @@
 // The state and env channels of a served subject (clone or local-tree): `subject.envValues`,
 // the structural parse of `subject.state`, and subjectStateInvalidReason, the semantic check
 // parseStudy and the computer-use route share.
-import { containsSensitive } from "../../evidence/redaction.js";
+import { scanEncodedText } from "../../evidence/encoded-text.js";
 import { ENV_NAME_PATTERN, invalid, posInt, str, strList } from "./values.js";
 import { isRecord } from "../../run/type-guards.js";
 /**
@@ -29,9 +29,9 @@ export function parseEnvValues(raw) {
         if (value === undefined) {
             return invalid(`\`subject.envValues.${name}\` must be a string, number, or boolean.`);
         }
-        // Reuse the redaction module's own detector rather than inventing a second opinion about what
-        // a secret looks like; the two must never disagree about the same string.
-        if (containsSensitive(value)) {
+        // verify blocks a run whose files scanEncodedText reads as sensitive, so this refuses what that
+        // scan reads: a secret or local path as written, or decoded from base64 or an escape.
+        if (scanEncodedText(value).sensitive) {
             return invalid(`\`subject.envValues.${name}\` looks like a secret or a local path, and envValues are committed with the study and recorded in evidence. List the name in \`subject.env\` instead: its value then comes from your environment and is never stored.`);
         }
         envValues[name] = value;

package/dist/study/participant-assignment.js

@@ -1,9 +1,9 @@
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 /** Project only authored participant-facing fields. Never pass runtime-composed instructions:
  * they can contain inbox URLs or multiplayer grants. Pick fields explicitly so a task's hidden
  * success criteria cannot cross this evidence boundary, even from an untyped library caller. */
 export function participantAssignment(assignment, scrubKnownValues = (text) => text) {
-    const sanitize = (text) => redactText(scrubKnownValues(text));
+    const sanitize = (text) => redactEncodedText(scrubKnownValues(text));
     return {
         mission: sanitize(assignment.mission),
         ...(assignment.focus === undefined ? {} : { focus: sanitize(assignment.focus) }),

package/dist/study/persona.d.ts

@@ -37,7 +37,13 @@ export declare function parseResolvedPersona(raw: unknown, fallback: {
 }, warnings?: string[]): ResolvedPersona;
 export declare function personaToDirectives(persona: ResolvedPersona): PersonaDirectives;
 export declare function renderPersonaPromptSection(persona: ResolvedPersona): string;
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
 export declare function personaBrief(persona: ResolvedPersona, scrub?: (text: string) => string): NonNullable<ActorPersonaRef["brief"]>;
 export declare function scrubPersonaBrief(persona: ActorPersonaRef, scrub: (text: string) => string): ActorPersonaRef;
 export {};

package/dist/study/persona.js

@@ -1,3 +1,4 @@
+import { redactEncodedText } from "../evidence/encoded-text.js";
 import { digestText, redactText } from "../evidence/redaction.js";
 import { isRecord } from "../run/type-guards.js";
 export const PERSONA_BACKGROUND_MAX_BYTES = 32 * 1024;
@@ -136,8 +137,9 @@ export function personaToDirectives(persona) {
         ...(patience ? [`patience:${patience}`] : []),
         ...(skill ? [`skill:${skill}`] : []),
     ];
+    // A live participant's trace records traitsApplied as it is, and the need is free text.
     if (accessibilityNeeds)
-        traitsApplied.push(`accessibility:${accessibilityNeeds}`);
+        traitsApplied.push(`accessibility:${redactEncodedText(accessibilityNeeds)}`);
     if (persona.constraints.length)
         traitsApplied.push(`constraints:${persona.constraints.length}`);
     return {
@@ -166,9 +168,15 @@ export function renderPersonaPromptSection(persona) {
         .filter(Boolean)
         .join("\n\n");
 }
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
-export function personaBrief(persona, scrub = (text) => text) {
-    const original = renderPersonaPromptSection(persona), text = redactText(scrub(original));
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
+export function personaBrief(persona, scrub) {
+    const original = renderPersonaPromptSection(persona), text = scrub === undefined ? redactText(original) : redactEncodedText(scrub(original));
     return {
         compilerVersion: PERSONA_COMPILER_VERSION,
         text,
@@ -180,7 +188,7 @@ export function personaBrief(persona, scrub = (text) => text) {
 export function scrubPersonaBrief(persona, scrub) {
     if (!persona.brief)
         return persona;
-    const text = redactText(scrub(persona.brief.text));
+    const text = redactEncodedText(scrub(persona.brief.text));
     return {
         ...persona,
         brief: {

package/dist/study/plan-base.js

@@ -1,7 +1,7 @@
 // What every route planner shares: the plan fields common to all routes, the frozen residual config,
 // and the requirement and subject helpers.
 import { DEFAULT_OPENAI_CU_MODEL } from "../actors/computer-use/openai-provider.js";
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 // A YAML alias can make a parsed record contain itself (an inline persona that names its own
 // anchor), and structuredClone keeps the cycle, so each object is frozen once.
 function deepFreeze(value, frozen = new WeakSet()) {
@@ -112,8 +112,9 @@ export function planBase(config, input) {
     return {
         studyId: config.id,
         // Every bundle writer takes the title from here, and review.md, run.json and the Observer show
-        // it, so a key or sandbox URL in it would make verify grade the run blocked.
-        ...(config.title === undefined ? {} : { title: redactText(config.title) }),
+        // it, so a key or sandbox URL in it, as written or encoded, would make verify grade the run
+        // blocked.
+        ...(config.title === undefined ? {} : { title: redactEncodedText(config.title) }),
         residual: residualOf(config),
         dryRun: input.dryRun,
         ...(analysis === undefined