humanish 0.19.1 → 0.20.1

package/dist/concurrent-shared-world-lab.js

@@ -41,7 +41,7 @@ import { toErrorMessage } from "./command-failure.js";
 import { mapWithConcurrency } from "./concurrency.js";
 import { commandDigestOf, composeLaneInstructions, defaultPackLocalTree, provisionCloneSubject, provisionLocalTreeSubject, resolveLaneDevice, resolveSubjectState, runCuaLane } from "./cua-actor-lab.js";
 import { createDesktopSandbox, loadE2BDesktopModule } from "./e2b-desktop-launch.js";
-import { concurrentSharedWorldValidationReason } from "./lab-config.js";
+import { concurrentSharedWorldValidationReason, externalPublicSharedWorldValidationReason } from "./lab-config.js";
 import { buildObserverData } from "./observer-data.js";
 import { attachObserverRuntimeStreamUrls, renderObserver } from "./observer.js";
 import { redactText } from "./redaction.js";
@@ -69,6 +69,208 @@ const SUBJECT_PROVISION_BUDGET_MS = 30 * 60_000;
 const DEFAULT_STATE_STEP_TIMEOUT_MS = 5 * 60_000;
 const DEFAULT_PROBER_CADENCE_MS = 1000;
 const DEFAULT_MISSION = "You are one of MANY users hitting a shared web application at the same time. The browser is already open at the app. Accomplish your role's task, then stop.";
+// EXTERNAL-PUBLIC plane class: the honest-downgrade attribution ceiling. The concurrent family
+// (an honest ceiling) PLUS the mandatory external-public disclosures — mirrored in run.ts's required
+// set (CONCURRENT_ATTRIBUTION_LIMITS + EXTERNAL_PUBLIC_EXTRA_LIMITS). Verify fails closed on a missing one.
+export const EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS = [
+    ...CONCURRENT_ATTRIBUTION_LIMITS,
+    "external-public-plane",
+    "operator-attested-target-not-harness-controlled",
+    "no-synthetic-attestation",
+    "no-authoritative-shared-state-proof",
+    "concurrency-by-temporal-co-occupancy-only"
+];
+// The FLOOR for the host-first handoff barrier deadline (ms). The host seat must surface a
+// shared-session (/lobby/CODE) URL within the deadline or the run fails closed and no follower
+// opens. The effective deadline SCALES with the per-seat run budget (execution.timeoutMs): a fixed
+// 2 min is too tight for a real create-a-lobby flow on a mobile-layout seat once you subtract the
+// seat's own desktop provisioning — the host reaches /lobby/CODE, but after the followers already
+// gave up. So use max(FLOOR, 40% of the budget), capped at the budget. The latch resolves the
+// instant the host actually reaches /lobby, so a generous ceiling only affects the fail-closed case.
+const DEFAULT_HANDOFF_DEADLINE_MS = 120_000;
+const HANDOFF_DEADLINE_BUDGET_FRACTION = 0.4;
+// Runaway backstop for the vision-off-frame handoff relay: at most this many single-frame reads before
+// the host is assumed to be somewhere without a code. The relay stops the instant any path latches, so
+// in practice only a handful fire (the host reaches /lobby within a few turns). NOTE: these reads are
+// out-of-band OpenAI calls (host-lane setup, external-public route only) and are NOT counted against
+// execution.caps.maxUsd — this hard cap is what bounds their spend instead (each read is one cheap
+// single-frame OCR call). If this route ever runs under a strict budget, fold the estimate in.
+const MAX_HOST_VISION_READS = 30;
+// Idle/no-progress backstop for the HOST lane specifically (default is 6/8). The host legitimately sits
+// on an unchanging waiting-room screen while followers provision and join; it must not give up first.
+const HOST_WAIT_IDLE_STEPS = 80;
+const FOLLOWER_WAIT_IDLE_STEPS = 40;
+/**
+ * The cineguessr (and general "/lobby/CODE") shared-session URL matcher. A code is exactly 6 chars of
+ * the [A-Z2-9] class; a locale prefix (/en/lobby/…) and a query/hash suffix are tolerated. RUNTIME-ONLY
+ * input (a live location.href); only the extracted CODE is used, and it lands only as a digest.
+ */
+export const LOBBY_CODE_PATTERN = /\/lobby\/([A-Z2-9]{6})(?:$|[/?#])/;
+/** Extract the shared-session CODE from a (runtime-only) observed URL, or undefined. Exported for the
+ *  handoff regex table test — pure, no side effects, never persists its input. */
+export function extractLobbyCode(url) {
+    if (typeof url !== "string")
+        return undefined;
+    const match = url.match(LOBBY_CODE_PATTERN);
+    return match ? match[1] : undefined;
+}
+/**
+ * Extract a lobby CODE from free-form ACTOR NARRATION (the host's reasoning/message where it states
+ * the lobby URL it sees), where the /lobby/CODE is followed by arbitrary prose (a space, backtick,
+ * newline) rather than end-of-string or /?# — so the strict LOBBY_CODE_PATTERN would miss it. Uses a
+ * negative-lookahead boundary (exactly 6 code chars). This is the CDP-INDEPENDENT handoff path: the
+ * host reads the code on screen and states it, and this reads it from the model's own text. Pure;
+ * input is runtime-only; only the code is used (as a digest).
+ */
+const LOBBY_CODE_IN_TEXT = /\/lobby\/([A-Z2-9]{6})(?![A-Z2-9])/;
+export function extractLobbyCodeFromNarration(text) {
+    if (typeof text !== "string")
+        return undefined;
+    const inUrl = text.match(LOBBY_CODE_IN_TEXT);
+    if (inUrl)
+        return inUrl[1];
+    // Fallback: an explicitly-labeled bare code (e.g. "LOBBY_CODE=ABC123"), which the host may state
+    // if it copied the code rather than the URL. The label is matched case-insensitively, but the CODE
+    // itself must be UPPERCASE [A-Z2-9] — a real lobby code always renders uppercase, whereas an /i match
+    // on the code class would also grab an ordinary lowercase word after "lobby code " (e.g. "the lobby
+    // code screen") and latch a WRONG code. Precision-first, matching parseLobbyCodeReply's rationale.
+    const labeled = text.match(/lobby[ _-]?code[=:\s]+([A-Z2-9]{6})(?![A-Za-z2-9])/i);
+    return labeled && labeled[1] && /^[A-Z2-9]{6}$/.test(labeled[1]) ? labeled[1] : undefined;
+}
+/** Pull the assistant's plain text out of an OpenAI Responses API body (`output_text` convenience
+ *  field, else the concatenated `output[].content[].text`). Tolerant of shape drift; pure. */
+export function extractResponsesOutputText(parsed) {
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const obj = parsed;
+    if (typeof obj.output_text === "string" && obj.output_text.length > 0)
+        return obj.output_text;
+    const out = obj.output;
+    if (!Array.isArray(out))
+        return undefined;
+    const parts = [];
+    for (const item of out) {
+        if (typeof item !== "object" || item === null)
+            continue;
+        const content = item.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const chunk of content) {
+            if (typeof chunk === "object" && chunk !== null && typeof chunk.text === "string") {
+                parts.push(chunk.text);
+            }
+        }
+    }
+    return parts.length > 0 ? parts.join("\n") : undefined;
+}
+/** Parse a vision reply into a lobby CODE. PRECISION-FIRST: accept ONLY when the whole reply IS the
+ *  six-character code, or when it echoes an explicit /lobby/CODE — never a bare 6-letter token buried in
+ *  prose (e.g. "I see a home SCREEN"), because a wrong latch fails the entire run, whereas a miss just
+ *  retries on the next frame while the host keeps waiting. NONE (the instructed "no code" reply) is
+ *  rejected. Pure. */
+export function parseLobbyCodeReply(reply) {
+    if (typeof reply !== "string")
+        return undefined;
+    const up = reply.trim().toUpperCase();
+    if (up.length === 0 || /\bNONE\b/.test(up))
+        return undefined;
+    if (/^[A-Z2-9]{6}$/.test(up))
+        return up; // the well-behaved "code only" reply
+    const inUrl = up.match(/\/LOBBY\/([A-Z2-9]{6})(?![A-Z2-9])/); // model echoed the invite link
+    return inUrl ? inUrl[1] : undefined;
+}
+const LOBBY_CODE_VISION_PROMPT = "This is a screenshot of a CineGuessr multiplayer lobby. If a waiting-room / invite screen is " +
+    "shown, read the 6-character lobby code (characters A-Z and 2-9 only) — it appears near a 'lobby " +
+    "code'/'room code' label or inside an invite link of the form /lobby/CODE. Your entire reply MUST be " +
+    "exactly those 6 characters in uppercase and NOTHING else (no words, no punctuation). If no lobby " +
+    "code is visible on this screen (e.g. it is the home screen or a game round), reply exactly NONE.";
+const LOBBY_CODE_VISION_ENDPOINT = "https://api.openai.com/v1/responses";
+// A single-frame OCR-style read. gpt-5.5 (the CU default) is used deliberately: it reliably reads the
+// 6-char code off a dense MOBILE-viewport waiting room — a smaller/cheaper model (gpt-4.1-mini) was
+// tried and could NOT read it. reasoning.effort stays "low" (minimal) and the output budget is small
+// but comfortably clear of the "incomplete on reasoning overflow" edge. Kept on the same account/key
+// as the actor; the same full-fidelity frame is already sent to this API by the CU provider, so this
+// adds no new data-exposure surface. See onScreenshot in runHostLane.
+const LOBBY_CODE_VISION_MODEL = "gpt-5.5";
+// Output-token budget for the read. The answer is 6 chars, but leave clear margin over any low-effort
+// reasoning tokens so the response never comes back status:"incomplete" with empty output.
+const LOBBY_CODE_VISION_MAX_OUTPUT_TOKENS = 64;
+// Per-read wall-clock cap. Without it a stalled fetch (Node fetch has no default timeout) would leave
+// visionInFlight pinned true and silently kill the relay for the rest of the host run.
+const LOBBY_CODE_VISION_TIMEOUT_MS = 15_000;
+/**
+ * Vision-read a lobby CODE straight off a host waiting-room FRAME (the robust, CDP-independent handoff
+ * relay). Fail-soft: any network/HTTP/parse problem returns undefined so the caller simply retries on
+ * the next frame. The frame is runtime-only; only the extracted code is used (as a digest downstream).
+ */
+export async function readLobbyCodeFromFrame(frame, apiKey, options = {}) {
+    if (typeof apiKey !== "string" || apiKey.length === 0 || frame.length === 0)
+        return undefined;
+    const fetchFn = options.fetchFn ?? fetch;
+    // Default a wall-clock timeout so a stalled request can't wedge the caller's in-flight guard. An
+    // explicit signal (e.g. run abort) takes precedence when provided.
+    const signal = options.signal ?? AbortSignal.timeout(LOBBY_CODE_VISION_TIMEOUT_MS);
+    const body = {
+        model: options.model ?? LOBBY_CODE_VISION_MODEL,
+        reasoning: { effort: "low" },
+        max_output_tokens: LOBBY_CODE_VISION_MAX_OUTPUT_TOKENS,
+        input: [
+            {
+                role: "user",
+                content: [
+                    { type: "input_text", text: LOBBY_CODE_VISION_PROMPT },
+                    { type: "input_image", image_url: `data:image/png;base64,${frame.toString("base64")}` }
+                ]
+            }
+        ]
+    };
+    let res;
+    try {
+        res = await fetchFn(options.endpoint ?? LOBBY_CODE_VISION_ENDPOINT, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+            signal
+        });
+    }
+    catch {
+        return undefined; // transient network error: skip this frame, next turn retries
+    }
+    if (!res.ok)
+        return undefined; // never read a non-ok body (it can echo the frame/input)
+    let parsed;
+    try {
+        parsed = await res.json();
+    }
+    catch {
+        return undefined;
+    }
+    return parseLobbyCodeReply(extractResponsesOutputText(parsed));
+}
+/** A minimal resolve-once latch for the host-first handoff barrier. */
+function deferred() {
+    let resolve;
+    let reject;
+    let done = false;
+    const promise = new Promise((res, rej) => {
+        resolve = (value) => { if (!done) {
+            done = true;
+            res(value);
+        } };
+        reject = (reason) => { if (!done) {
+            done = true;
+            rej(reason);
+        } };
+    });
+    return { promise, resolve, reject, settled: () => done };
+}
+/** Marker error the host-first barrier rejects with when the deadline elapses (fail-closed). */
+class HandoffTimeoutError extends Error {
+    constructor(deadlineMs) {
+        super(`the host never produced a /lobby/CODE URL within the ${deadlineMs}ms handoff deadline`);
+        this.name = "HandoffTimeoutError";
+    }
+}
 function readPositiveInt(value, fallback) {
     if (value === undefined)
         return fallback;
@@ -188,6 +390,35 @@ function buildActorSpec(config, role, index) {
         traceArtifactPath: `actors/${streamId}.json`
     };
 }
+/** Thread the host-yielded lobby CODE into a follower's mission at runtime (external-public route).
+ *  The CODE flows into the follower's join instruction; it is persisted only as the composed prompt
+ *  the model reads (never a raw bundle field), and the lab scrubs the CODE from all narration. The
+ *  follower joins through the real UI (a direct /lobby/CODE visit does not auto-join a non-member). */
+function withLobbyCodeMission(spec, code) {
+    return {
+        ...spec,
+        instructions: `${spec.instructions}\n\nThe multiplayer lobby code is ${code}. On the home screen choose Join, enter this lobby code, enter your name, and submit to join the shared game (do not open a lobby URL directly — go through the Join flow).`
+    };
+}
+/** A follower lane that failed closed at the host-first barrier (the host never yielded a /lobby/CODE
+ *  within the deadline): it NEVER opened a browser, so it carries no session/screenshots — just the
+ *  handoff-timeout reason. actorLanePassed(...) is false (no session), so it is honestly non-pass. */
+function makeBlockedFollowerOutcome(spec, deadlineMs) {
+    return {
+        spec,
+        sessionError: `handoff barrier: the host never surfaced a /lobby/CODE URL within ${deadlineMs}ms; this follower failed closed WITHOUT opening (no wasted turns).`,
+        killed: false,
+        streamUrlPresent: false,
+        screenshots: [],
+        stateStepRecords: [],
+        phaseRecords: [],
+        warnings: [],
+        noEngagement: true,
+        selfReportedBlocker: false,
+        harnessError: false,
+        skippedReason: "handoff-timeout"
+    };
+}
 async function writeConcurrentRunArtifacts(bundle, preparedRunPaths) {
     const runPaths = await validatePreparedRunArtifactPaths(preparedRunPaths);
     const publicBundle = {
@@ -253,11 +484,20 @@ export async function runConcurrentSharedWorld(options) {
     if (!descriptor || !isCuaActorDescriptor(descriptor)) {
         return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_ACTOR_UNSUPPORTED", `actors[0].type "${actorType}" is not a registered computer-use actor.`);
     }
-    // Re-enforce the concurrent cross-validation (library API surface).
-    const invalidReason = concurrentSharedWorldValidationReason(config);
+    // The PLANE-class discriminator (#164 phase 2): an app-url subject is the EXTERNAL-PUBLIC plane (a
+    // real operator-owned public deployment used directly as the shared plane — NO getHost, clone,
+    // subject sandbox, or seed); everything else is the historical provisioned-getHost plane.
+    const planeClass = config.subject.source === "app-url" ? "external-public" : "provisioned-getHost";
+    // Re-enforce the cross-validation (library API surface). The external-public branch NEVER touches
+    // the getHost synthetic gate — that gate exists because getHost is internet-reachable AND
+    // harness-owned; a public site the harness neither provisioned nor exposed has neither property.
+    const invalidReason = planeClass === "external-public"
+        ? externalPublicSharedWorldValidationReason(config)
+        : concurrentSharedWorldValidationReason(config);
     if (invalidReason) {
         return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", invalidReason, descriptor.id);
     }
+    // provisioned-getHost fields (all absent on the external-public plane — forbidden at validation).
     const serve = config.subject.serve;
     const localTreeRoute = config.subject.source === "local-tree";
     const subjectRepo = config.subject.repos?.[0] ?? "";
@@ -315,6 +555,38 @@ export async function runConcurrentSharedWorld(options) {
     let snapshotIndex = 0;
     let liveObserver;
     const runtimeStreamUrls = [];
+    // EXTERNAL-PUBLIC plane state (#164 phase 2). publicAppUrl is the operator-declared shared plane;
+    // its ORIGIN is persisted digest-only (publicOriginDigest), never raw (the raw URL + the runtime
+    // observed lobby CODE never land — TENSION 3). The latch code is scrubbed from all narration.
+    const publicAppUrl = config.subject.appUrl ?? "";
+    // The operator-DECLARED origin (from subject.appUrl) — recorded for evidence/reference ONLY. The
+    // operator-OWNERSHIP claim rests on the subject.publicTarget.authorized attestation + this declared
+    // appUrl, NOT on digest equality (blocker 2): a normal cross-origin redirect (apex->www, http->https;
+    // cineguessr.com 307-redirects) makes the seats' OBSERVED origin differ from the declared one, which
+    // is expected and MUST NOT fail the run. Persisted digest-only (never the raw origin).
+    const declaredOriginDigest = planeClass === "external-public" && publicAppUrl
+        ? hostOriginDigest(publicAppUrl)
+        : undefined;
+    // The OBSERVED convergence origin — computed AFTER fan-out from what the seats ACTUALLY reached (the
+    // convergence proof is what the seats OBSERVED, not what was declared). Set iff every observing seat
+    // agrees on ONE origin; that agreement IS the convergence proof and becomes plane.publicOriginDigest.
+    let publicOriginDigest;
+    // Per-lane runtime-only observed state (never persisted raw): the last observed URL and the last
+    // observed /lobby/CODE per seat, fed by onObservedUrl. The URL is digested to ORIGIN for each seat's
+    // routeHostDigest (no code leaks); the codes drive the cross-seat lobby-convergence digest.
+    const observedFinalUrls = new Array(roles.length);
+    const observedLobbyCodes = new Array(roles.length);
+    let lobbyConvergenceDigest;
+    let handoffTimedOut = false;
+    // A closure that scrubs the latched lobby CODE from ANY persisted narration once the host resolves
+    // it (the 6-char code has no detectable secret shape, so shape-only redaction cannot catch it).
+    let latchedLobbyCode;
+    const scrubKnownValuesWithLobbyCode = (text) => {
+        const base = scrubKnownValues(text);
+        return latchedLobbyCode && latchedLobbyCode.length > 0
+            ? base.split(latchedLobbyCode).join("[REDACTED_LOBBY_CODE]")
+            : base;
+    };
     // Pack the working tree ONCE per run, on the host, BEFORE the subject sandbox is created
     // (mirrors the sequential route + the cua route's ordering): a packing failure fails the run
     // closed here, never spending sandbox cost. Dry-run packs nothing.
@@ -337,7 +609,11 @@ export async function runConcurrentSharedWorld(options) {
             return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_FAILED", `local-tree packing failed: ${redactText(scrubKnownValues(toErrorMessage(error)))}`, descriptor.id);
         }
     }
-    if (!dryRun) {
+    if (!dryRun && planeClass === "provisioned-getHost") {
+        if (!serve) {
+            // Defense-in-depth: concurrentSharedWorldValidationReason already required serve above.
+            return fail("HUMANISH_CONCURRENT_SHARED_WORLD_LAB_INVALID", "the provisioned-getHost concurrent shared-world route requires `subject.serve`.", descriptor.id);
+        }
         let subjectModule;
         let subjectDesktop;
         // Background prober dispose signal (FIX-9: cleared in finally).
@@ -567,16 +843,285 @@ export async function runConcurrentSharedWorld(options) {
             }
         }
     }
-    const subjectState = resolveSubjectState({ declared: config.subject.state, dryRun, executed: stateStepRecords });
+    // EXTERNAL-PUBLIC plane (#164 phase 2): NO subject sandbox, NO getHost, NO prober. The shared plane
+    // is the operator-declared public deployment (publicAppUrl); each seat opens it directly and reaches
+    // the shared session through the real UI. A host-first barrier extracts the /lobby/CODE from the host
+    // seat's CDP-observed URL (onObservedUrl) and threads it into the follower missions; a follower fails
+    // closed WITHOUT opening if the host never yields a code within the handoff deadline.
+    if (!dryRun && planeClass === "external-public") {
+        const cuaHooks = {
+            ...(hooks.loadDesktopModule ? { loadDesktopModule: hooks.loadDesktopModule } : {}),
+            ...(hooks.detachedTimers ? { detachedTimers: hooks.detachedTimers } : {}),
+            ...(hooks.env ? { env: hooks.env } : {}),
+            ...(hooks.prepareDesktop ? { prepareDesktop: (desktop) => hooks.prepareDesktop(desktop) } : {}),
+            onRuntimeStreamReady: (stream) => {
+                runtimeStreamUrls.push({ streamId: stream.streamId, url: stream.url });
+                if (liveObserver) {
+                    attachObserverRuntimeStreamUrls(liveObserver, runtimeStreamUrls);
+                }
+            }
+        };
+        const baseActorDeps = {
+            config,
+            descriptor,
+            cloneRoute: false,
+            subjectEnvNames: [],
+            hasGithubToken: false,
+            env,
+            openaiApiKey,
+            e2bApiKey,
+            requestTimeoutMs,
+            perLaneSandboxMs: timeoutMs + SANDBOX_TIMEOUT_BUFFER_MS,
+            timeoutMs,
+            laneCount: roles.length,
+            artifactRoot: runPaths,
+            redactScreenshots,
+            // Scrub the latched lobby CODE (known once the host resolves it) from ALL narration.
+            scrubKnownValues: scrubKnownValuesWithLobbyCode,
+            runSession,
+            now,
+            hooks: cuaHooks,
+            screenMismatchPolicy: "record-evidence"
+        };
+        // Publish an attached live Observer BEFORE fan-out (mirrors the provisioned path).
+        if (options.onObserverReady) {
+            const inProgressBundle = buildConcurrentSharedWorldBundle({
+                config,
+                descriptor,
+                createdAt,
+                dryRun: false,
+                inProgress: true,
+                runId,
+                source,
+                roles,
+                actorSpecs,
+                actorResults: [],
+                stateSnapshots: [],
+                subject: { source: "app-url", envNames: [], state: { provenance: "external-public" } },
+                seedDigest,
+                planeClass: "external-public",
+                // Pre-fan-out snapshot: no seat has observed an origin yet, so the OBSERVED publicOriginDigest
+                // is not available; surface the DECLARED origin for the live Observer's reference.
+                ...(declaredOriginDigest === undefined ? {} : { declaredOriginDigest })
+            });
+            await writeConcurrentRunArtifacts(inProgressBundle, runPaths);
+            liveObserver = observerResultForConcurrentArtifacts(cwd, runId, artifactRoot, [
+                "Live external-public concurrent shared-world Observer is attached before final verification; stream auth URLs are runtime-only and are not persisted."
+            ]);
+            await options.onObserverReady(liveObserver);
+        }
+        // The host-first handoff barrier.
+        //
+        // TEMPORARY SHIM (tracked by #296): this CDP URL-relay handoff — reading the host's /lobby/CODE off
+        // its own browser and threading it into the follower missions — is a temporary coordination shim.
+        // It is to be augmented/replaced by the actor message bus (faux SMS/email invite) in #297: the
+        // human-realistic version is the HOST SENDING the invite link and followers RECEIVING and tapping
+        // it, rather than the orchestrator relaying the code out-of-band.
+        const lobbyCodeLatch = deferred();
+        const handoffDeadlineMs = hooks.handoffDeadlineMs
+            ?? Math.min(timeoutMs, Math.max(DEFAULT_HANDOFF_DEADLINE_MS, Math.floor(timeoutMs * HANDOFF_DEADLINE_BUDGET_FRACTION)));
+        let deadlineTimer;
+        const deadline = new Promise((_resolve, reject) => {
+            deadlineTimer = setTimeout(() => reject(new HandoffTimeoutError(handoffDeadlineMs)), handoffDeadlineMs);
+        });
+        deadline.catch(() => undefined); // never an unhandled rejection
+        // Resolve the host->follower handoff latch from WHICHEVER path sees the code first (CDP url-read,
+        // host narration, or vision-off-frame). Idempotent: only the first code wins, and it is also stashed
+        // as latchedLobbyCode so it gets scrubbed from any later narration. The latched code and observed URLs
+        // are runtime-only and land in persisted METADATA only as digests (origin + convergence). (The code
+        // is a shareable game code, not a secret, and it still renders in the host's screenshots, which are
+        // full-fidelity unless redactScreenshots is set — the digesting is about narration/URL metadata.)
+        const latchLobbyCode = (code, laneIndex) => {
+            if (latchedLobbyCode !== undefined)
+                return;
+            observedLobbyCodes[laneIndex] = code;
+            latchedLobbyCode = code;
+            if (deadlineTimer) {
+                clearTimeout(deadlineTimer);
+                deadlineTimer = undefined;
+            }
+            lobbyCodeLatch.resolve(code);
+        };
+        const makeLaneObservedUrl = (laneIndex, isHost) => (url) => {
+            if (typeof url !== "string" || url.length === 0)
+                return;
+            observedFinalUrls[laneIndex] = url; // runtime-only; digested to origin, never persisted raw
+            const code = extractLobbyCode(url);
+            if (code !== undefined) {
+                observedLobbyCodes[laneIndex] = code;
+                if (isHost)
+                    latchLobbyCode(code, laneIndex);
+            }
+        };
+        // The HOST lane (which yields the /lobby/CODE the followers wait on) runs on its OWN dedicated
+        // slot, and the FOLLOWERS run through a bounded pool of size concurrency-1 (blockers 1 & 4):
+        // followers block on `Promise.race([lobbyCodeLatch.promise, deadline])` while holding a worker
+        // slot, so if the host lane were scheduled INSIDE the same bounded pool it could be starved (never
+        // scheduled among the first `concurrency` workers) and the run would die with a spurious
+        // HANDOFF_TIMEOUT (e.g. lanes [p2,p3,host] with concurrency 2). Giving the host its own slot,
+        // started IMMEDIATELY and OUTSIDE the follower pool, guarantees it is ALWAYS schedulable regardless
+        // of its roster position or of concurrency vs lane count — while total in-flight paid desktops stay
+        // ≤ the declared concurrency (host + up to concurrency-1 followers), preserving the spend cap.
+        const runHostLane = async (spec, laneIndex) => {
+            const onObservedUrl = makeLaneObservedUrl(laneIndex, true);
+            // CDP-INDEPENDENT handoff paths (the E2B-desktop CDP url-read the onObservedUrl path relies on is
+            // unreliable in practice). Two backups, both resolving the SAME latch; whichever sees the code first
+            // wins, all digest-only:
+            //   (1) onMessage — scan the host's own narration IF it happens to state the lobby URL; and
+            //   (2) onScreenshot — vision-read the code straight off the host's waiting-room frame. This is the
+            //       robust one: the code is rendered on screen even when CDP fails AND when the host never
+            //       narrates it, and — crucially — the host is NOT asked to announce anything, so it keeps
+            //       running (create -> wait for players -> Start -> play) instead of ending on a stray message.
+            const onMessage = (text) => {
+                if (latchedLobbyCode !== undefined)
+                    return;
+                const code = extractLobbyCodeFromNarration(text);
+                if (code !== undefined)
+                    latchLobbyCode(code, laneIndex);
+            };
+            let visionInFlight = false;
+            let visionReads = 0;
+            const onScreenshot = (frame) => {
+                // One read at a time, only until latched, and bounded so a host that never reaches a lobby can't
+                // rack up unbounded vision calls (~30 cheap single-frame reads is far past when the code appears).
+                if (latchedLobbyCode !== undefined || visionInFlight || visionReads >= MAX_HOST_VISION_READS)
+                    return;
+                visionInFlight = true;
+                visionReads += 1;
+                void readLobbyCodeFromFrame(frame, openaiApiKey)
+                    .then((code) => {
+                    if (code !== undefined && latchedLobbyCode === undefined)
+                        latchLobbyCode(code, laneIndex);
+                })
+                    .catch(() => undefined)
+                    .finally(() => {
+                    visionInFlight = false;
+                });
+            };
+            // The host's job includes a long LEGITIMATE idle wait — sitting in the waiting room while the
+            // followers provision their own desktops and walk the Join flow (easily 15-30 turns of an
+            // unchanging "waiting for players" screen). At the default idle backstop (6) the host would give up
+            // before anyone arrives, orphaning the lobby (exactly the earlier failure). Raise the host's idle /
+            // no-progress tolerance so it waits patiently; the per-seat timeout still bounds a truly stuck host.
+            const hostSpec = {
+                ...spec,
+                idleSteps: spec.idleSteps ?? HOST_WAIT_IDLE_STEPS,
+                noProgressSteps: spec.noProgressSteps ?? HOST_WAIT_IDLE_STEPS
+            };
+            const startedAt = now();
+            let outcome;
+            try {
+                outcome = await runCuaLane(hostSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl, onMessage, onScreenshot });
+            }
+            finally {
+                // If the host finished without ever surfacing a code, release followers to fail closed
+                // immediately rather than wait the full deadline (a no-op if it already resolved).
+                lobbyCodeLatch.reject(new HandoffTimeoutError(handoffDeadlineMs));
+            }
+            const endedAt = now();
+            return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
+        };
+        const runFollowerLane = async (spec, laneIndex) => {
+            const onObservedUrl = makeLaneObservedUrl(laneIndex, false);
+            // FOLLOWER: do NOT compose a mission or open the target until the host yields a lobby code.
+            let code;
+            try {
+                code = await Promise.race([lobbyCodeLatch.promise, deadline]);
+            }
+            catch {
+                // Fail closed WITHOUT opening (no wasted turns against a codeless home page).
+                handoffTimedOut = true;
+                const at = now();
+                return { spec, outcome: makeBlockedFollowerOutcome(spec, handoffDeadlineMs), startedAt: at, endedAt: at, route: publicAppUrl };
+            }
+            // Followers also idle-wait — in the waiting room until the host starts, and between rounds. Raise
+            // their idle backstop too (less than the host's: they wait less), so a follower that joins ahead of
+            // the other does not give up before the game begins. Per-seat timeout still bounds a stuck follower.
+            const followerSpec = {
+                ...withLobbyCodeMission(spec, code),
+                idleSteps: spec.idleSteps ?? FOLLOWER_WAIT_IDLE_STEPS,
+                noProgressSteps: spec.noProgressSteps ?? FOLLOWER_WAIT_IDLE_STEPS
+            };
+            const startedAt = now();
+            const outcome = await runCuaLane(followerSpec, { ...baseActorDeps, appUrl: publicAppUrl, onObservedUrl });
+            const endedAt = now();
+            return { spec, outcome, startedAt, endedAt, route: observedFinalUrls[laneIndex] ?? publicAppUrl };
+        };
+        // Split the roster into the designated host lane and the followers, preserving each follower's
+        // ORIGINAL lane index so results land back in lane order (validation guarantees EXACTLY ONE host).
+        const hostLaneIndex = roles.findIndex((role) => role.host === true);
+        const followerEntries = actorSpecs
+            .map((spec, index) => ({ spec, index }))
+            .filter(({ index }) => index !== hostLaneIndex);
+        const laneResults = new Array(actorSpecs.length);
+        try {
+            const hostPromise = hostLaneIndex >= 0 && actorSpecs[hostLaneIndex] !== undefined
+                ? runHostLane(actorSpecs[hostLaneIndex], hostLaneIndex)
+                : undefined;
+            const followerResultsPromise = mapWithConcurrency(followerEntries, Math.max(1, concurrency - 1), ({ spec, index }) => runFollowerLane(spec, index));
+            const [hostResult, followerResults] = await Promise.all([hostPromise, followerResultsPromise]);
+            if (hostResult !== undefined && hostLaneIndex >= 0) {
+                laneResults[hostLaneIndex] = hostResult;
+            }
+            followerEntries.forEach((entry, i) => { laneResults[entry.index] = followerResults[i]; });
+            actorResults = laneResults;
+        }
+        catch (error) {
+            runError = redactText(scrubKnownValuesWithLobbyCode(toErrorMessage(error)));
+            warnings.push(`External-public concurrent shared-world run failed before completion: ${runError}`);
+        }
+        finally {
+            if (deadlineTimer) {
+                clearTimeout(deadlineTimer);
+                deadlineTimer = undefined;
+            }
+        }
+        // Observed-origin convergence proof (blocker 2): the convergence claim is about what the seats
+        // OBSERVED, not what was DECLARED. Digest each observing seat's origin and require they AGREE on
+        // ONE — that agreement IS the convergence proof and becomes plane.publicOriginDigest. A normal
+        // cross-origin redirect (declared apex -> observed www) is therefore tolerated: the seats still
+        // converge on ONE observed origin. Leave it undefined (verify fails closed) only if the seats did
+        // not converge on a single observed origin (or none observed one).
+        const observedOriginDigests = observedFinalUrls
+            .filter((url) => typeof url === "string" && url.length > 0)
+            .map((url) => hostOriginDigest(url));
+        const distinctObservedOrigins = new Set(observedOriginDigests);
+        publicOriginDigest = distinctObservedOrigins.size === 1
+            ? [...distinctObservedOrigins][0]
+            // NOTHING observed (e.g. a handoff-timeout run where no seat ever navigated): fall back to the
+            // DECLARED origin so a FAILED run's bundle stays structurally valid (every seat's route then
+            // digests to the declared origin too). The run still fails closed for its own reason (HANDOFF_
+            // TIMEOUT / no lobby convergence / no overlap-on-pass). GENUINE divergence (≥2 distinct observed
+            // origins) leaves it undefined so verify fails closed on the non-convergence.
+            : distinctObservedOrigins.size === 0
+                ? declaredOriginDigest
+                : undefined;
+        // Lobby-convergence proof: a digest of the shared /lobby/CODE path iff EVERY seat converged on the
+        // SAME code (a follower stuck on "/" yields no code → no false convergence). Digest-only. NOTE:
+        // observedLobbyCodes may be a SPARSE array (a seat that never observed a code leaves a hole), and
+        // Array.prototype.every SKIPS holes — so count the DEFINED codes explicitly, never rely on every().
+        const definedCodes = observedLobbyCodes.filter((code) => code !== undefined);
+        const distinctCodes = new Set(definedCodes);
+        if (distinctCodes.size === 1 && definedCodes.length === roles.length) {
+            lobbyConvergenceDigest = commandDigestOf(`/lobby/${[...distinctCodes][0]}`);
+        }
+        if (handoffTimedOut && runError === undefined) {
+            runError = `The host seat never produced a /lobby/CODE URL within the ${handoffDeadlineMs}ms handoff deadline; follower seats failed closed without opening.`;
+        }
+    }
+    // Subject provenance: external-public is the operator-declared, operator-owned public deployment
+    // (neither provisioned nor seeded); the provisioned path builds clone/local-tree provenance.
+    const subject = planeClass === "external-public"
+        ? { source: "app-url", envNames: [], state: { provenance: "external-public" } }
+        : buildSubjectProvenance({
+            localTreeRoute,
+            publicRepo,
+            subjectCommit: localTreeRoute ? localTreeArchive?.git?.commit : subjectCommit,
+            localTreeArchive,
+            subjectEnvNames,
+            state: resolveSubjectState({ declared: config.subject.state, dryRun, executed: stateStepRecords })
+        });
     const planeCommit = localTreeRoute ? localTreeArchive?.git?.commit : subjectCommit;
-    const subject = buildSubjectProvenance({
-        localTreeRoute,
-        publicRepo,
-        subjectCommit: planeCommit,
-        localTreeArchive,
-        subjectEnvNames,
-        state: subjectState
-    });
     // Collect per-actor warnings (each lane's own teardown/raw-screenshot notes).
     for (const result of actorResults) {
         warnings.push(...result.outcome.warnings);
@@ -594,8 +1139,12 @@ export async function runConcurrentSharedWorld(options) {
         stateSnapshots,
         subject,
         seedDigest,
+        planeClass,
         ...(planeCommit === undefined ? {} : { subjectCommit: planeCommit }),
         ...(getHostUrl === undefined ? {} : { hostDigest: hostOriginDigest(getHostUrl) }),
+        ...(publicOriginDigest === undefined ? {} : { publicOriginDigest }),
+        ...(declaredOriginDigest === undefined ? {} : { declaredOriginDigest }),
+        ...(lobbyConvergenceDigest === undefined ? {} : { lobbyConvergenceDigest }),
         ...(runError === undefined ? {} : { runError })
     });
     const adapterWarnings = [];
@@ -673,6 +1222,13 @@ export async function runConcurrentSharedWorld(options) {
     const errorResult = (() => {
         if (ok)
             return undefined;
+        if (handoffTimedOut) {
+            // Checked BEFORE the observer failure: the host never yielded a /lobby/CODE within the
+            // deadline (followers failed closed without opening), which is the ROOT CAUSE — and it can
+            // itself make the Observer unable to render a coherent run. Report the distinct, honest
+            // handoff-timeout code rather than a generic observer/run failure.
+            return { code: "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_HANDOFF_TIMEOUT", message: runError ?? "The host seat never produced a /lobby/CODE URL within the handoff deadline." };
+        }
         if (!observer.ok) {
             return { code: "HUMANISH_CONCURRENT_SHARED_WORLD_LAB_FAILED", message: observer.error?.message ?? "Observer failed for the concurrent shared-world run." };
         }
@@ -735,13 +1291,15 @@ function actorLanePassed(result) {
 export function buildConcurrentSharedWorldBundle(args) {
     const { config, descriptor, createdAt, dryRun, actorSpecs, actorResults, roles } = args;
     const inProgress = args.inProgress === true;
+    const external = (args.planeClass ?? "provisioned-getHost") === "external-public";
     const simulations = [];
     const streams = [];
     const events = [];
-    // Public-safe label only — the raw getHost URL never lands in the bundle (it embeds the live
-    // sandbox id + matches the e2b-URL redaction). The host identity is carried by plane.hostDigest.
-    const appUrl = "[provisioned-subject]";
-    const planeCommit = dryRun ? undefined : args.subjectCommit;
+    // Public-safe label only — neither the raw getHost URL (provisioned) nor the raw public origin
+    // (external-public) lands in the bundle. The plane identity is a DIGEST (plane.hostDigest on
+    // getHost; plane.publicOriginDigest on external-public).
+    const appUrl = external ? "[external-public-plane]" : "[provisioned-subject]";
+    const planeCommit = external ? undefined : dryRun ? undefined : args.subjectCommit;
     events.push({
         id: "event-000-created",
         at: createdAt,
@@ -760,14 +1318,20 @@ export function buildConcurrentSharedWorldBundle(args) {
             ? `packed working tree (archiveSha256 ${args.subject.archiveSha256}${args.subject.dirty === true ? ", dirty working tree" : args.subject.dirty === false ? ", clean working tree" : ""})`
             : "packed working tree (archive digest unresolved; provisioning failed before resolution)")
         : `clone of ${args.subject.repo}${args.subjectCommit ? `@${args.subjectCommit}` : ""}`;
+    // External-public plane provenance is HONESTLY different: an operator-declared, operator-OWNED
+    // public deployment humanish neither provisioned nor seeded — NO getHost, NO clone, NO synthetic
+    // attestation (claiming synthetic on a real site is a lie). The origin persists digest-only.
+    const externalPlaneOwner = config.subject.publicTarget?.owner ?? "(operator-declared)";
     events.push({
         id: "event-001-plane",
         at: createdAt,
         level: "info",
         type: "concurrent-shared-world.plane.provenance",
-        message: dryRun
-            ? `Shared plane declared: ${dryRunPlaneLabel}, served + getHost-exposed in-sandbox (dry-run contract; nothing ${args.subject.source === "local-tree" ? "packed" : "cloned"}). Seed recipe ${args.seedDigest}; SYNTHETIC subject (author-attested); env names: ${args.subject.envNames?.join(", ") || "none"} (values never persisted).`
-            : `Shared plane: ${livePlaneLabel}, served + exposed at the harness-minted getHost URL; seed recipe ${args.seedDigest}; SYNTHETIC subject (author-attested); env names: ${args.subject.envNames?.join(", ") || "none"} (values never persisted).`,
+        message: external
+            ? `Shared plane: an EXTERNAL-PUBLIC deployment (operator-attested owner ${externalPlaneOwner}, authorized) used DIRECTLY as the shared plane — NO getHost, clone, subject sandbox, or seed. The harness OBSERVES that each seat reached the operator-declared origin (publicOriginDigest); it did NOT mint or control the plane. Author-trust ownership attestation, NOT a synthetic-data claim.`
+            : dryRun
+                ? `Shared plane declared: ${dryRunPlaneLabel}, served + getHost-exposed in-sandbox (dry-run contract; nothing ${args.subject.source === "local-tree" ? "packed" : "cloned"}). Seed recipe ${args.seedDigest}; SYNTHETIC subject (author-attested); env names: ${args.subject.envNames?.join(", ") || "none"} (values never persisted).`
+                : `Shared plane: ${livePlaneLabel}, served + exposed at the harness-minted getHost URL; seed recipe ${args.seedDigest}; SYNTHETIC subject (author-attested); env names: ${args.subject.envNames?.join(", ") || "none"} (values never persisted).`,
         simId: actorSpecs[0]?.simId ?? "sim-001",
         streamId: actorSpecs[0]?.streamId ?? "stream-001"
     });
@@ -780,7 +1344,8 @@ export function buildConcurrentSharedWorldBundle(args) {
         const session = outcome?.session;
         const screenshots = outcome?.screenshots ?? [];
         const lastScreenshot = screenshots[screenshots.length - 1];
-        const route = publicSafeRouteLabel(roles[index]?.entry); // public-safe (host redacted)
+        // public-safe (origin redacted): external-public seats open the public plane; getHost seats a seat path.
+        const route = external ? "[external-public-plane]" : publicSafeRouteLabel(roles[index]?.entry);
         const status = session
             ? session.status
             : outcome?.sessionError
@@ -921,9 +1486,12 @@ export function buildConcurrentSharedWorldBundle(args) {
             });
         }
     });
-    // Build the concurrent shared-world evidence block. routeHostDigest is sha256-16 of the ORIGIN of
-    // the getHost seat URL each actor drove (publish-safe; verify confirms it == plane.hostDigest).
-    const fallbackHostDigest = args.hostDigest ?? commandDigestOf("[provisioned-subject]");
+    // Build the concurrent shared-world evidence block. routeHostDigest is sha256-16 of the ORIGIN each
+    // seat reached: on getHost the seat URL the actor drove (verify confirms == plane.hostDigest); on
+    // external-public the seat's CDP-OBSERVED URL origin (verify confirms == plane.publicOriginDigest).
+    const fallbackHostDigest = external
+        ? (args.publicOriginDigest ?? commandDigestOf("[external-public-plane]"))
+        : (args.hostDigest ?? commandDigestOf("[provisioned-subject]"));
     const laneWindows = actorSpecs.map((spec, index) => {
         const result = actorResults[index];
         const session = result?.outcome.session;
@@ -943,9 +1511,14 @@ export function buildConcurrentSharedWorldBundle(args) {
             seedDigest: args.seedDigest
         };
     });
-    const stateSeries = dryRun
-        ? [{ timestamp: 0, digest: declaredStateDigest(config) }]
-        : [...args.stateSnapshots].sort((a, b) => a.timestamp - b.timestamp);
+    // Option A (external-public): NO authoritative shared-state proof — OMIT stateSeries entirely (there
+    // is no in-sandbox filesystem to digest; concurrency is proven by temporal co-occupancy + lobby
+    // convergence). The provisioned-getHost plane keeps its authoritative in-sandbox checkpoint series.
+    const stateSeries = external
+        ? undefined
+        : dryRun
+            ? [{ timestamp: 0, digest: declaredStateDigest(config) }]
+            : [...args.stateSnapshots].sort((a, b) => a.timestamp - b.timestamp);
     const outcomes = actorSpecs.map((spec, index) => {
         const result = actorResults[index];
         const session = result?.outcome.session;
@@ -962,31 +1535,54 @@ export function buildConcurrentSharedWorldBundle(args) {
             ok
         };
     });
-    const sharedWorld = {
-        schema: SHARED_WORLD_SCHEMA,
-        topology: "shared-world",
-        topologyMode: "concurrent",
-        roleCount: actorSpecs.length,
-        plane: {
+    // The plane block is plane-class-specific. getHost: harness-minted hostDigest + synthetic
+    // attestation. external-public: operator-declared publicOriginDigest, NO hostDigest, NO exposure
+    // (claiming synthetic on a real site would be a lie — verify asserts both ABSENT there).
+    const plane = external
+        ? {
+            seedDigest: args.seedDigest,
+            envNames: [],
+            // publicOriginDigest is the OBSERVED convergence origin; declaredOriginDigest records the
+            // operator-declared origin for reference (a redirect makes them differ — not a failure).
+            ...(args.publicOriginDigest === undefined ? {} : { publicOriginDigest: args.publicOriginDigest }),
+            ...(args.declaredOriginDigest === undefined ? {} : { declaredOriginDigest: args.declaredOriginDigest })
+        }
+        : {
             ...(planeCommit === undefined ? {} : { commit: planeCommit }),
             seedDigest: args.seedDigest,
             envNames: args.subject.envNames ?? [],
             ...(args.hostDigest === undefined ? {} : { hostDigest: args.hostDigest }),
             exposure: "synthetic"
-        },
-        attributionLimits: [...CONCURRENT_ATTRIBUTION_LIMITS],
+        };
+    const sharedWorld = {
+        schema: SHARED_WORLD_SCHEMA,
+        topology: "shared-world",
+        topologyMode: "concurrent",
+        // Byte-stable: the provisioned-getHost plane omits planeClass (absent == provisioned-getHost).
+        ...(external ? { planeClass: "external-public" } : {}),
+        roleCount: actorSpecs.length,
+        plane,
+        attributionLimits: external ? [...EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS] : [...CONCURRENT_ATTRIBUTION_LIMITS],
         laneWindows,
-        stateSeries,
-        outcomes
+        // Option A: external-public carries NO stateSeries.
+        ...(stateSeries === undefined ? {} : { stateSeries }),
+        outcomes,
+        ...(args.lobbyConvergenceDigest === undefined ? {} : { lobbyConvergenceDigest: args.lobbyConvergenceDigest })
     };
     const overlaps = actorWindowsOverlap(actorResults);
-    const deltas = stateSeries.filter((snapshot, i) => i > 0 && snapshot.digest !== stateSeries[i - 1].digest).length;
+    const deltas = (stateSeries ?? []).filter((snapshot, i) => i > 0 && snapshot.digest !== (stateSeries ?? [])[i - 1].digest).length;
+    const stateSeriesLabel = external
+        ? "stateSeries omitted (no authoritative shared-state proof on the external-public plane)"
+        : `stateSeries ${(stateSeries ?? []).length} snapshot(s), ${deltas} delta(s)`;
+    const convergenceLabel = external
+        ? `; lobby convergence ${args.lobbyConvergenceDigest ? "PROVEN (all seats reached one /lobby/CODE)" : "not observed"}`
+        : "";
     events.push({
         id: nextEventId("concurrency"),
         at: createdAt,
         level: "info",
         type: "concurrent-shared-world.concurrency",
-        message: `Concurrency: ${laneWindows.length} actor window(s)${dryRun ? " (dry-run contract; $0)" : `, overlap ${overlaps ? "PROVEN" : "not observed"}`}; stateSeries ${stateSeries.length} snapshot(s), ${deltas} delta(s). Attribution ceiling: ${sharedWorld.attributionLimits.join(", ")}. ${dryRun ? "This contract-only run proves no live concurrency, scale, or adoption." : "This run reports only its own observed overlap and state changes; it does not prove scale, repeatability, or adopter-harness replacement."}`
+        message: `Concurrency: ${laneWindows.length} actor window(s)${dryRun ? " (dry-run contract; $0)" : `, overlap ${overlaps ? "PROVEN" : "not observed"}`}; ${stateSeriesLabel}${convergenceLabel}. Attribution ceiling: ${sharedWorld.attributionLimits.join(", ")}. ${dryRun ? "This contract-only run proves no live concurrency, scale, or adoption." : "This run reports only its own observed overlap and state changes; it does not prove scale, repeatability, or adopter-harness replacement."}`
     });
     // Concurrent verdict: dryRun → contract; else every actor produced a terminal, engaged PASSED
     // session → pass; otherwise fail. Per-persona mission success is the M-of-N in outcomes[].
@@ -1002,11 +1598,18 @@ export function buildConcurrentSharedWorldBundle(args) {
     const review = {
         schema: REVIEW_SCHEMA,
         verdict,
+        // Plane-class-aware: the external-public plane has NO getHost/clone/seed and carries NO
+        // authoritative state series, so its summary must not claim a getHost-exposed plane (dry-run) nor
+        // report "state delta(s) under load" (live) — it reports lobby convergence instead.
         summary: dryRun
-            ? `Dry-run concurrent shared-world contract: ${actorSpecs.length} persona(s) declared against ONE getHost-exposed plane (${descriptor.id}); no sandboxes launched, $0 spend.`
+            ? external
+                ? `Dry-run concurrent shared-world contract: ${actorSpecs.length} persona(s) declared against ONE external-public shared plane (a real public deployment used directly; no getHost/clone/seed); no sandboxes launched, $0 spend.`
+                : `Dry-run concurrent shared-world contract: ${actorSpecs.length} persona(s) declared against ONE getHost-exposed plane (${descriptor.id}); no sandboxes launched, $0 spend.`
             : inProgress
                 ? `In-progress concurrent shared-world Observer snapshot: ${actorSpecs.length} persona(s) running against ONE shared plane; final verification is pending.`
-                : `Concurrent shared-world (ONE plane, ${actorSpecs.length} simultaneous personas): swarm ${verdict === "pass" ? "ran coherently" : "did not run coherently"}; ${passedMissions}/${actorSpecs.length} reached their goal; overlap ${overlaps ? "proven" : "not observed"}; ${deltas} state delta(s) under load.`,
+                : external
+                    ? `Concurrent shared-world (ONE external-public plane, ${actorSpecs.length} simultaneous personas): swarm ${verdict === "pass" ? "ran coherently" : "did not run coherently"}; ${passedMissions}/${actorSpecs.length} reached their goal; overlap ${overlaps ? "proven" : "not observed"}; ${args.lobbyConvergenceDigest ? `${actorSpecs.length} seats converged on one lobby` : "lobby convergence not observed"}.`
+                    : `Concurrent shared-world (ONE plane, ${actorSpecs.length} simultaneous personas): swarm ${verdict === "pass" ? "ran coherently" : "did not run coherently"}; ${passedMissions}/${actorSpecs.length} reached their goal; overlap ${overlaps ? "proven" : "not observed"}; ${deltas} state delta(s) under load.`,
         gaps: dryRun
             ? ["This dry-run launched no concurrent shared-world session; it proves contract shape only, not live behavior, scale, or adopter-harness replacement."]
             : inProgress