humanish 0.76.0 → 0.78.0

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.76.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.78.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.

package/docs/goals/current.md

@@ -29,7 +29,7 @@ study completed, reproduced, and produced a real accessibility finding via a
 keyboard-first participant
 ([docs/goals/email-gated-signup/receipts/](email-gated-signup/receipts/)).
 
-## Current Program Truth (source `0.76.0`)
+## Current Program Truth (source `0.78.0`)
 
 The package source and repository implementation in this tree agree on these
 points:
@@ -463,11 +463,43 @@ Stop and correct course if:
 
 ## Best Next Work
 
+**2026-09-04, later (0.78.0).** `@e2b/desktop` moved from 2.2.3 to 2.3.3 (#638): its 2.3.1
+changelog names the socket #581 found today, a background command's event stream the SDK kept
+open after `Xvfb` and `startxfce4` were launched, which held the CLI process alive twelve minutes
+past a run's written result. `doctor` now prints the installed desktop SDK version on its row and
+attaches an advisory with the fix below 2.3.1 (#639). A live try-live on the new SDK reached its
+goal in 104 s and settled with no active resources.
+
+**2026-09-04 (0.77.0).** Four fixes found by runs and one by a scanner. A phone-emulated lane now
+follows the participant into a tab that opens later: the hold-mode applier attaches to every page
+target Chrome creates, paused before its first navigation, so the new tab lays out at the phone
+width, and the state observer reads each new tab's own fidelity report, recording a covered tab
+under `desktopGeometry.fidelity.laterTargets` (width, DPR, touch points) and a drifted one as a
+lane warning with the number the page gave; the applier's own log travels as `holderLog`. The
+first live proof failed in the participant's hands (a paused popup never resumed) and the shipped
+design is the one four live runs settled on: never pause a later tab, send the overrides the
+moment it exists, reload it once after its first navigation commits
+(`docs/goals/computer-use-actor/receipts/later-tab-emulation-2026-09-04.md`, #623, #636). A sandbox create
+or archive upload that fails on a transient provider error is retried once and named on the lane
+(#630): six lanes started 20 s apart lost five to E2B SDK errors before any turn, a probe of the
+same SDK a minute later worked in 6 s. The provider's `Retry-After` now governs a retry (capped
+at 60 s) and a `403 misalignment_policy_violation` ends the lane named and unresumed (#633). The
+provisioned-clone CI flake runs on an injected clock (#276 closed). The fourth benchmark run on
+this build read 15 of 15 planted defects with nothing invented in three clean runs, cumulative 58
+of 60 (`bench/RESULTS-2026-09-04-0.76.0.md`). humanish.dev negotiates `Accept: text/markdown`
+and llms.txt says when to use humanish (#634).
+
+## Best Next Work
+
 **2026-09-03, later (0.76.0).** A hosted Chromium lane on a mobile preset can now be a
 mobile-emulated browser: `execution.desktop.fidelity.mobileEmulation: true` applies a real 414 px
 CSS viewport, the preset's device pixel ratio, touch events and a mobile user agent before the
 participant's first observation, and the bundle records what the page then reported about itself
 under `desktopGeometry.fidelity` (#221, `docs/goals/computer-use-actor/receipts/mobile-emulation-2026-09-03.md`).
+On the published 0.76.0, with touch emulated, neither phone participant on TodoMVC could rename at
+all (a double-tap selects text; the double-click editor never opens), where the 500 px runs without
+touch had finished and only called the rename touch-hostile: the responsive-viewport study reported
+an opinion, the mobile-emulated study reported a blocker.
 The persona axis was replicated the same evening on drawDB and TodoMVC and given a third app,
 Excalidraw, as the clean control (`persona-axis-phone-2026-09-03.md`); a multi-lane study's
 second and third findings reach `feedback draft` through `--candidate` (#609); a negated report
@@ -489,7 +521,7 @@ gpt-6-astra is priced. #548 closed on the benchmark receipts.
 
 **2026-09-01 (0.66.0 through 0.70.0, one session).** The product got its first efficacy numbers and
 they are in the repo with run ids: planted-defect recall 43 of 45 over three benchmark runs and
-12 clean runs with nothing invented (`bench/`), 5 of 6 findings confirmed on TodoMVC and 11 of 12
+12 clean runs with nothing invented (`bench/`; 58 of 60 and 15 clean runs after the 09-04 rerun), 5 of 6 findings confirmed on TodoMVC and 11 of 12
 on drawDB against the source (20 participants on apps we did not write, 0 false reports), and the
 persona question answered on two apps: every keyboard-first participant hit a defect no
 mouse-driving participant met (drawDB's mouse-only database modal, TodoMVC's double-click-only
@@ -504,9 +536,10 @@ and a Claude participant with no memory across turns (#520). `humanish stats` (#
 
 The standing queue, in rough order:
 
-1. #581: after a failed terminal run the CLI process lingered sixteen minutes past its result;
-   the lane is clean in-process, so the holder is the SDK or the shell (`HUMANISH_DEBUG_HANDLES=1`
-   now names it on the next occurrence);
+1. #581, the remaining half: a `Sandbox.create` that fails after the API allocated the sandbox
+   (the desktop SDK's own startup) leaves a sandbox this run never learned the id of, reclaimed only
+   by the provider's timeout; the linger itself is the SDK's held command stream, closed by the
+   2.3.3 bump (0.78.0), and `doctor` names an older SDK;
 2. #513: there is still nowhere to read the docs on humanish.dev (site copy is locked; a docs
    route needs the operator's sign-off);
 3. the TUI views over `stats` and `export` (#455's metrics screen and `s` key), design-gated;

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.76.0` (2026-09-03). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.78.0` (2026-09-04). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [
@@ -103,7 +103,7 @@
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.0",
-    "@e2b/desktop": "^2.2.3",
+    "@e2b/desktop": "^2.3.3",
     "@types/node": "^20.19.41",
     "@types/pngjs": "^6.0.5",
     "tsx": "^4.22.4",