humanish 0.89.1 → 0.91.0

package/dist/tui-contract.d.ts

@@ -51,8 +51,9 @@ export interface TuiCapabilities {
     openObserver(cwd: string, observerPath: string): Promise<TuiActionResult>;
     /** Stop the sandboxes an interrupted run left behind, keeping its evidence. */
     reclaimRun(cwd: string, runId: string): Promise<ReclaimResult>;
-    /** End a run that is still going. Stops the PROCESS; `reclaimRun` stops what it provisioned. */
-    stopRun(cwd: string, runId: string): Promise<TuiActionResult>;
+    /** End a run that is still going. "analysis" is marker-only regardless of the current status;
+     * it MUST NOT probe or signal a process. The default "run" intent stops the participant process. */
+    stopRun(cwd: string, runId: string, intent?: "run" | "analysis"): Promise<TuiActionResult>;
     /**
      * Set this directory up as a humanish project. The surface's only WRITING action outside of
      * starting runs — offered because "cd somewhere else and run init" is a dead end shown to

package/dist/tui-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"tui-contract.js","sourceRoot":"","sources":["../src/tui-contract.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,mGAAmG;AACnG,mBAAmB;AA8FnB,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,OAAO,CAAC,OAAO;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,+BAA+B,kBAAkB,cAAc,KAAK,CAAC,WAAW,mCAAmC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,WAAW;QACtB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,kJAAkJ,CAAC;AACzJ,CAAC"}
+{"version":3,"file":"tui-contract.js","sourceRoot":"","sources":["../src/tui-contract.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,mGAAmG;AACnG,6DAA6D;AAC7D,EAAE;AACF,mGAAmG;AACnG,mBAAmB;AA+FnB,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,OAAO,CAAC,OAAO;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,+BAA+B,kBAAkB,cAAc,KAAK,CAAC,WAAW,mCAAmC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,OAAO,KAAK,CAAC,WAAW;QACtB,CAAC,CAAC,yEAAyE;QAC3E,CAAC,CAAC,kJAAkJ,CAAC;AACzJ,CAAC"}

package/docs/architecture/examples/state-driven-local-app/README.md

@@ -73,3 +73,8 @@ npx tsc --allowJs --checkJs --noEmit --strict --skipLibCheck --types node --targ
 See the [state-driven executor guide](../../state-driven-executor.md) for progress
 projection limits, runtime-only state, unpinned local-app provenance, and the
 fail-closed guards on this route.
+
+The example explicitly sets `review: { analysis: false }` to keep post-run
+analysis free of provider requests too. Supported live recordings otherwise
+use the separate default analysis budget; a deterministic participant provider
+does not replace the analysis provider.

package/docs/architecture/examples/state-driven-local-app/runner.mjs

@@ -68,6 +68,7 @@ try {
     // This registry id selects the CUA loop. buildProvider supplies the actual provider.
     actors: [{ type: "openai-computer-use", persona: "pixel-pat", mission: "Greet the app." }],
     scenario: { mode: "live" },
+    review: { analysis: false }, // Keep this deterministic example free of provider requests.
     execution: { timeoutMs: 15_000 }
   });
   if (!parsed.ok) throw new Error(parsed.error.message);

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.89.1`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.91.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.

package/docs/contracts/study-analysis.md

@@ -1,8 +1,11 @@
 # Study analysis
 
-Study analysis is an optional interpretation of retained participant evidence.
+Study analysis is an independent interpretation of retained participant evidence.
 It is separate from the participant's account, recorded outcome, and the run's
 deterministic review verdict. Opening an Observer never starts a provider request.
+Supported live runs request analysis on completion by default, with a separate
+$3 admission estimate limit. Set `review.analysis: false` to disable that request;
+see [automatic analysis](../product/automatic-analysis.md).
 
 ## Invocation
 
@@ -59,18 +62,50 @@ stopped, an operator can remove the empty lock directory and retry.
 
 The packet currently admits up to 16 participants, 800 evidence items, 40 PNG
 captures, 160 KiB of text and 20 MiB of images. Individual source files, image
-dimensions and result sizes have separate limits. Selection follows retained
-source order; it is not a statistically representative sample. Selection
+dimensions and result sizes have separate limits. Count and text budgets are
+distributed across included participants, with unused capacity from short
+sessions available to longer ones. Capture selection prioritizes session endings
+and beginnings, context around recorded failures, and spread across each whole
+session. Failure priority uses structured source status, not application-specific
+keywords or image interpretation. Unflagged visual errors may still be omitted.
+Bounded reads and the total image byte limit can reduce coverage further.
+Selected entries retain their original source order, frame and event identities;
+this is not a statistically representative sample. Selection
 omissions and unreadable or invalid capture files make declared coverage
 incomplete. Coverage records file availability and selection; it does not
 certify visual legibility, correct interpretation, or exhaustive issue discovery.
 
+New packets declare `captureVersion: 2`, bound into their input digest. They
+include captures attached to `screenshot` and scripted `ui_action` events,
+preserving the original action IDs and evidence basis. Error notices that refer
+to an earlier capture retain that context without creating another frame.
+Scripted lanes use their recorded `ui.intent` goal when no participant assignment
+exists. Missing assignments and declared captures without supported trace
+references are explicit omissions. Artifacts without `captureVersion` continue
+to validate against the original capture mapping; previously saved selections
+are not recomputed or rewritten.
+
 The standard review covers session summary, apparent intent, observed outcome,
 friction, dead ends, recovery, and participant feedback. Findings are ordered by
 observed task impact, replication among exposed participants, and recovery.
 Impact and confidence remain separate. There is no numeric frustration or
 universal priority score.
 
+The standard review also accounts for material participant concerns before
+ranking findings. Reported uncertainty can be useful even when the interface is
+correct or study setup may explain it. Claims distinguish that experience from
+an established product defect, preserve consequential recoveries, and check
+participant accounts against the actual assignment and captured state.
+
+New results include `concernReviews`: evidence-linked observations with a
+`finding`, `context`, or `unsupported` disposition and a concise reason. A finding
+disposition references an existing local finding ID; other dispositions use null.
+The Observer's **Concerns considered** disclosure exposes these decisions and
+their original evidence. There is no required finding count or inventory of every
+thought. Older reports may omit this field and remain readable. The disclosure
+is model-generated assessment, not an independent completeness audit or a human
+reviewer annotation.
+
 Every observation cites packet-local evidence IDs. The model cannot choose a
 filesystem path or fetch another resource. Validation checks participant
 membership, unique counts, quote fidelity, evidence type and reference
@@ -80,6 +115,8 @@ is correct or every consequential issue was found.
 
 Elapsed replay time starts at the first retained capture. It is not a video
 offset. Nonvisual events retain event identity without invented frame offsets.
+Scripted captures without recorded timestamps keep null analysis times; any
+uniform playback pacing is an estimate, not an observed duration.
 
 ## Durable records
 
@@ -94,8 +131,15 @@ status, usage and validated findings:
   analysis/<analysis>/corrections/<correction>/correction.json
   analysis-attempts/<analysis>/receipt.json
   observer/study-analysis.json
+  analysis-automatic/job.json  # post-run lifecycle; never a retry instruction
 ```
 
+The optional automatic job is separate from the immutable analysis. Its view
+binds terminal state to the exact execution receipt and report. A stale or
+unverifiable job remains unknown; reading or exporting it never dispatches.
+Automatic job metadata is omitted from shared derivatives. See
+[automatic analysis](../product/automatic-analysis.md).
+
 Version and correction directories are claimed exclusively; publication is
 atomic. Source evidence is not rewritten. Minimal execution receipts retain
 model, budget, status and known usage even if source changes prevent report

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-15. Release baseline: `0.89.1`.
+Status date: 2026-09-15. Release baseline: `0.91.0`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.89.1-analysis-finished-notice.md).
+in the [release notes](../release/0.91.0-analysis-quality-and-defaults.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.89.1`)
+## Current Program Truth (source `0.91.0`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -99,7 +99,7 @@ substitute for it.
 | Shared state | Sequential and concurrent single-origin shared-world studies with retained evidence | Multi-origin implementation remains gated; concurrent state change does not establish per-action causation |
 | Observer | Live/recorded views, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
 | Review and feedback | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication |
-| Study findings | Explicit `analyze`, bounded evidence selection, versioned findings, exact source links and append-only corrections within the Observer study shell | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
+| Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
 | TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving and run library | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |
 | Off-app communication | In-sandbox email/SMS catch and digest-only thread evidence | This does not establish real-provider delivery |
 | Mobile and media | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed | Physical-device and touch fidelity remain unproven; unsupported microphone declarations are rejected |

package/docs/principles/invariants-and-defaults.md

@@ -34,9 +34,12 @@ certify (see the conformance suite).
    terminal) is only ever pointed at a URL the harness itself issued or validated under a
    declared policy (loopback entry, provisioned subject, declared external target). Never an
    arbitrary URL from unvalidated input.
-3. **Live spend is explicit.** No configuration default, omission, or fallback may cause
-   provider or sandbox spend. Spend requires an affirmative declaration (`scenario.mode:
-   live`, an env opt-in gate for spend-bearing tests).
+3. **Live spend requires an explicit live invocation.** No omission or fallback may
+   turn a dry run, preview, reader or unsupported route into provider or sandbox
+   spend. An explicitly live supported study includes the disclosed default
+   post-run analysis budget unless `review.analysis: false` disables it. Analysis
+   has a separate admission estimate limit, not a provider billing cap or part of
+   the actor budget. Spend-bearing tests retain their explicit env gates.
 4. **Evidence verifies fail-closed.** A run bundle that cannot pass verification (schema,
    redaction status, artifact presence, public-safety scan) is a failed run, even when the
    session "worked." The gate applies to the harness's own error reports.
@@ -82,6 +85,7 @@ silently drifting from one is not.
 | Default | Why it is the default | Legitimate override |
 |---|---|---|
 | Dry-run | Spend safety (invariant 3 sets the floor; dry-run keeps the floor far away) | `scenario.mode: live` |
+| Post-run analysis on supported live studies | Findings accompany the recording; a separate $3 admission estimate limit is visible before execution | `review.analysis: false` disables it; an explicit mapping sets another analysis budget. Dry-run and unsupported routes never dispatch; missing default credentials produce a recorded skip |
 | Per-lane worlds | Isolation, attribution, reproducibility | `subject.topology: shared-world` — N seats against ONE provisioned, mutable plane for scenarios that ARE about interaction between roles (#164). `execution.concurrency: 1` (an explicit choice) = SEQUENTIAL turns (one sandbox); higher = CONCURRENT — and since #350 an omitted concurrency fills to the seat count, so every declared seat runs live at once by default (one getHost-exposed subject sandbox + N actor sandboxes driving it at once, synthetic-subject only). The bundle declares the weaker `attributionClass: shared-world` + a verify-enforced `attributionLimits` ceiling (the concurrent set drops `sequential-only` and adds `best-effort-causal-attribution` etc.), so the looser per-role attribution is honest, not hidden. |
 | External key placement | Smallest blast radius: when the keyed process (e.g. a computer-use provider loop) runs outside the sandbox, its key never enters | In-sandbox placement when the keyed process runs inside (an agent harness under test); declared per actor type, with a spend budget |
 | Loopback entry URLs | Public-safety: never drive third-party sites unbidden | `policies.allowPublicTargets` for an owner-declared deployment/preview (a Vercel preview of your own app). Multi-lane public/preview fan-out needs explicit `actors[0].lanes[].target` for every lane, so the adapter-owned topology is declared rather than inferred. Provisioned clone subjects always serve in-sandbox on loopback |

package/docs/product/automatic-analysis.md

@@ -0,0 +1,81 @@
+# Automatic study analysis
+
+Supported live studies automatically request analysis after each recording finishes. Findings remain
+separate from participant feedback and the recorded study verdict.
+
+The default is `gpt-6-astra` with high reasoning effort, a separate $3 admission
+estimate limit, a 300-second timeout and 16,384 output tokens. To customize it:
+
+```yaml
+review:
+  analysis:
+    maxCostUsd: 3
+    # Optional; these values match manual analysis defaults.
+    model: gpt-6-astra
+    timeoutMs: 300000
+    maxOutputTokens: 16384
+    # question: Where did participants need to recover?
+```
+
+Omitting `review.analysis` uses these defaults. Set `review.analysis: false` to
+run participants without the additional analysis request. An explicit analysis
+mapping requires `maxCostUsd`. This limits an admission estimate, not the
+provider's final bill, and is separate from participant spending limits. Analysis
+sends selected retained text and captures to OpenAI using `OPENAI_API_KEY`.
+Analysis runs in the Humanish runner using its credentials. This setting adds no
+credential channel to the target application; each participant backend retains
+its existing authentication boundary. Review the separate analysis budget before running a manifest live; an actor's
+zero-dollar cap does not cap post-run analysis. The bundled first-contact
+zero-spend product fixture explicitly disables analysis.
+
+The same configuration works through `humanish run <lab>`, `lab run <lab>`,
+`watch <lab>`, and TUI live starts. Direct library calls to the five recording
+producers honor it too. Supported routes are computer-use, scripted-browser,
+terminal-product, sequential shared-world and concurrent shared-world. Synthetic,
+smoke and meta routes never enable analysis by default and reject an explicit
+analysis mapping before execution. `false` is accepted on every route. Dry runs show analysis
+as skipped, without reading analysis credentials or making a provider request.
+
+Participant execution finishes and its recording is finalized before analysis is
+queued. A participant who was blocked or interrupted can still have useful
+retained evidence; analysis requires a verified live recording, not a successful
+participant outcome. An active, missing or invalid recording is not analyzed.
+Default analysis also skips recordings containing only setup or failure records
+with no retained participant activity. A desktop startup failure does not start
+an analysis request. The original failure remains visible.
+
+CLI live starts disclose the separate admission estimate limit before execution.
+`humanish lab preflight <lab> --json` and the TUI lab screen also expose the
+resolved budget without dispatching analysis. Library callers can inspect
+`resolveAutomaticAnalysis` or `automaticAnalysisBudget` before running.
+
+The command waits for analysis and reports its separate state. A TUI-launched
+runner continues after the TUI closes; reopening the TUI or Observer reads the
+existing job and does not start another request. Concurrent or repeated automatic
+invocations cannot silently retry a paid attempt. If a process disappears while
+an attempt is in flight, its state can be unknown rather than falsely complete.
+Use manual `humanish analyze --run <exact-run-id> --max-cost 3` for an intentional
+follow-up after inspecting the existing attempt and its accounting.
+
+Stopping participant execution does not start a fresh automatic analysis. A
+recorded harness cancellation is skipped; ordinary time limits and participant
+abandonment remain eligible evidence.
+
+During analysis, Ctrl-C asks the request to cancel. The TUI's **Cancel analysis**
+action writes a cancellation request for that recording; it does not signal the
+finished participant process. Cancelling cannot undo provider work already
+accepted. Known usage is retained; missing usage remains unknown.
+
+The CLI's JSON keeps `runOk` for the original backend result, `automaticAnalysis`
+for post-run analysis, and `ok` for the overall request. Failed, cancelled or
+unknown analysis produces exit code 2 without discarding the recording. A missing
+`OPENAI_API_KEY` skips default analysis and preserves a successful run exit;
+`automaticAnalysisTrigger: "default"` distinguishes that case in JSON. A missing
+key for an explicitly configured analysis remains a failed overall request.
+Either skip is retained for review and does not retry automatically. Partial
+findings remain visibly partial; a valid partial result can succeed, while a
+partial result with an analysis error still fails the command. Recorded task
+outcomes and the deterministic review verdict are never rewritten by analysis.
+
+See the [analysis contract](../contracts/study-analysis.md) for selection limits,
+evidence validation, actual usage, corrections and share-safe export behavior.

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.89.1` (2026-09-15). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.91.0` (2026-09-15). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,15 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.91.0 release note](../release/0.91.0-analysis-quality-and-defaults.md)
+describes automatic analysis by default on supported live recordings, its
+separate disclosed budget and opt-out, fairer evidence selection, and
+evidence-linked review of material concerns and exclusions.
+
+The [0.90.0 release note](../release/0.90.0-automatic-analysis.md) describes
+opt-in analysis after live runs, truthful job states, cancellation, and scripted
+captures and assignments in findings and playback.
+
 The [0.89.1 release note](../release/0.89.1-analysis-finished-notice.md)
 clarifies that an analysis with limitations has finished.
 
@@ -95,7 +104,7 @@ Implemented:
 
 - `commander` CLI with stable command help;
 - `init`, `doctor`, `run`, `watch`, `verify`, `review`, `runs`, `analyze`, and `feedback`;
-- opt-in study analysis with bounded provider admission, immutable findings,
+- study analysis with bounded provider admission, a live-run default and opt-out, immutable findings,
   source-bound corrections and evidence-linked Observer review;
 - synthetic run bundles;
 - public-safety verification with machine-readable `shareSafety.status`

package/docs/release/0.90.0-automatic-analysis.md

@@ -0,0 +1,21 @@
+# 0.90.0 — Findings after live studies
+
+Labs can opt into independent analysis after their recording finishes with
+`review.analysis.maxCostUsd`. The command waits for the result; the TUI and
+Observer show analysis separately from participant execution and task outcomes.
+Without the setting, run behavior stays unchanged.
+
+The five supported live recording producers share the same completion boundary.
+Automatic analysis claims one attempt per recording, preserves usage and prior
+findings, and never starts again merely because a view is reopened. Cancellation
+requests target analysis without signaling the finished participant process.
+Recording identity remains pinned through dispatch, reuse and artifact writes.
+
+Scripted browser recordings now contribute their action-attached screenshots and
+declared goal to analysis and playback. Earlier saved analyses retain their
+original evidence mapping. Referenced error captures do not become duplicate
+frames. Missing assignments or unmapped captures remain visible limitations.
+
+See [automatic analysis](../product/automatic-analysis.md) for configuration,
+route support, spending and cancellation behavior. Analysis uses an admission
+estimate separate from participant caps; it is not a provider billing hard cap.

package/docs/release/0.91.0-analysis-quality-and-defaults.md

@@ -0,0 +1,33 @@
+# Humanish 0.91.0
+
+Supported live studies now request analysis when the recording finishes, using
+`gpt-6-astra` with high reasoning and a separate $3 admission estimate limit.
+The CLI, preflight and TUI disclose that budget. Set `review.analysis: false` to
+disable the extra request, or supply an analysis mapping with `maxCostUsd` to
+customize it. The estimate is additional to participant and desktop costs and
+is not a provider billing cap. Missing default credentials record a skip while
+preserving a successful recording; explicit analysis failures remain failures.
+Startup failures with no retained participant activity skip default analysis.
+
+Analysis now reviews material participant concerns before ranking findings.
+Useful reported uncertainty and recovered mistakes can remain findings even
+when product fault is unproven. **Concerns considered** shows evidence-linked
+decisions, including why material concerns were left out of the ranked list.
+It is model assessment, separate from original participant feedback and human
+reviewer annotations.
+
+Evidence selection shares count and text budgets across participants and samples
+their whole sessions, prioritizing beginnings, endings and context around
+recorded failures. Original frame and event identities remain intact. Missing
+assignments remain explicit; historical assignments are never invented.
+Existing analysis versions remain readable and unchanged.
+
+Selection is bounded and can still omit important moments. Concern review does
+not certify exhaustive discovery or accurate causal diagnosis. Opening Observer,
+exporting a recording and reading history never start a model request. Dry-runs
+and unsupported default routes remain request-free, and examples advertised as
+zero-spend explicitly disable automatic analysis.
+
+See the [analysis contract](../contracts/study-analysis.md),
+[automatic analysis guide](../product/automatic-analysis.md), and
+[bounded evaluation receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/analysis-quality-and-defaults-2026-09-15.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.89.1",
+  "version": "0.91.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [