humanish 0.90.0 → 0.91.1

package/docs/architecture/examples/state-driven-local-app/README.md

@@ -73,3 +73,8 @@ npx tsc --allowJs --checkJs --noEmit --strict --skipLibCheck --types node --targ
 See the [state-driven executor guide](../../state-driven-executor.md) for progress
 projection limits, runtime-only state, unpinned local-app provenance, and the
 fail-closed guards on this route.
+
+The example explicitly sets `review: { analysis: false }` to keep post-run
+analysis free of provider requests too. Supported live recordings otherwise
+use the separate default analysis budget; a deterministic participant provider
+does not replace the analysis provider.

package/docs/architecture/examples/state-driven-local-app/runner.mjs

@@ -68,6 +68,7 @@ try {
     // This registry id selects the CUA loop. buildProvider supplies the actual provider.
     actors: [{ type: "openai-computer-use", persona: "pixel-pat", mission: "Greet the app." }],
     scenario: { mode: "live" },
+    review: { analysis: false }, // Keep this deterministic example free of provider requests.
     execution: { timeoutMs: 15_000 }
   });
   if (!parsed.ok) throw new Error(parsed.error.message);

package/docs/contracts/run-bundle.md

@@ -210,6 +210,10 @@ bundles stay byte-stable. Each lane's own estimate also rides its
 from the reserved provider-returned `tokenUsage.costUsd`. See
 [`schemas.md`](schemas.md) → Run Cost Summary And Estimated Actor Cost.
 
+This bundle subtotal excludes separate study-analysis requests. Use
+`humanish stats` for the complete retained estimate and explicit accounting
+gaps across run costs and analysis attempts. See [study cost statistics](study-costs.md).
+
 `humanish verify` treats cost as ADVISORY on magnitude and FAIL-CLOSED on
 labeling: absence passes, but a claimed dollar figure without its `ratesAsOf`
 date + `source`, or a total that does not match its known lines, fails. Verify

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.90.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.91.1`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.
@@ -41,6 +41,7 @@ workflow without leaking private upstream truth into core.
 | Study analysis | `humanish.study-analysis.v1` | see [study analysis](study-analysis.md) and synthetic analysis fixtures in `tests/` |
 | Study analysis correction | `humanish.study-analysis-correction.v1` | see [study analysis](study-analysis.md#human-review-and-sharing) |
 | Analysis execution receipt | `humanish.analysis-execution.v1` | see [study analysis](study-analysis.md#durable-records) |
+| Analysis execution start | `humanish.analysis-execution-start.v1` | see [study analysis](study-analysis.md#durable-records) |
 | Verification | `humanish.verify-result.v1` | `five-check-verify` |
 | Policy | `humanish.policy.v1` (fixture-only; not engine-validated) | `public-safety-policy` |
 | Feedback | `humanish.feedback.v1` | `public-safe-feedback` |

package/docs/contracts/study-analysis.md

@@ -1,8 +1,11 @@
 # Study analysis
 
-Study analysis is an optional interpretation of retained participant evidence.
+Study analysis is an independent interpretation of retained participant evidence.
 It is separate from the participant's account, recorded outcome, and the run's
 deterministic review verdict. Opening an Observer never starts a provider request.
+Supported live runs request analysis on completion by default, with a separate
+$3 admission estimate limit. Set `review.analysis: false` to disable that request;
+see [automatic analysis](../product/automatic-analysis.md).
 
 ## Invocation
 
@@ -59,8 +62,15 @@ stopped, an operator can remove the empty lock directory and retry.
 
 The packet currently admits up to 16 participants, 800 evidence items, 40 PNG
 captures, 160 KiB of text and 20 MiB of images. Individual source files, image
-dimensions and result sizes have separate limits. Selection follows retained
-source order; it is not a statistically representative sample. Selection
+dimensions and result sizes have separate limits. Count and text budgets are
+distributed across included participants, with unused capacity from short
+sessions available to longer ones. Capture selection prioritizes session endings
+and beginnings, context around recorded failures, and spread across each whole
+session. Failure priority uses structured source status, not application-specific
+keywords or image interpretation. Unflagged visual errors may still be omitted.
+Bounded reads and the total image byte limit can reduce coverage further.
+Selected entries retain their original source order, frame and event identities;
+this is not a statistically representative sample. Selection
 omissions and unreadable or invalid capture files make declared coverage
 incomplete. Coverage records file availability and selection; it does not
 certify visual legibility, correct interpretation, or exhaustive issue discovery.
@@ -72,7 +82,8 @@ to an earlier capture retain that context without creating another frame.
 Scripted lanes use their recorded `ui.intent` goal when no participant assignment
 exists. Missing assignments and declared captures without supported trace
 references are explicit omissions. Artifacts without `captureVersion` continue
-to validate against the original selection rules.
+to validate against the original capture mapping; previously saved selections
+are not recomputed or rewritten.
 
 The standard review covers session summary, apparent intent, observed outcome,
 friction, dead ends, recovery, and participant feedback. Findings are ordered by
@@ -80,6 +91,21 @@ observed task impact, replication among exposed participants, and recovery.
 Impact and confidence remain separate. There is no numeric frustration or
 universal priority score.
 
+The standard review also accounts for material participant concerns before
+ranking findings. Reported uncertainty can be useful even when the interface is
+correct or study setup may explain it. Claims distinguish that experience from
+an established product defect, preserve consequential recoveries, and check
+participant accounts against the actual assignment and captured state.
+
+New results include `concernReviews`: evidence-linked observations with a
+`finding`, `context`, or `unsupported` disposition and a concise reason. A finding
+disposition references an existing local finding ID; other dispositions use null.
+The Observer's **Concerns considered** disclosure exposes these decisions and
+their original evidence. There is no required finding count or inventory of every
+thought. Older reports may omit this field and remain readable. The disclosure
+is model-generated assessment, not an independent completeness audit or a human
+reviewer annotation.
+
 Every observation cites packet-local evidence IDs. The model cannot choose a
 filesystem path or fetch another resource. Validation checks participant
 membership, unique counts, quote fidelity, evidence type and reference
@@ -92,6 +118,19 @@ offset. Nonvisual events retain event identity without invented frame offsets.
 Scripted captures without recorded timestamps keep null analysis times; any
 uniform playback pacing is an estimate, not an observed duration.
 
+Finding previews select from the finding's cited entries. They prefer a capture
+directly cited as visual evidence, then the number of distinct visual/action
+observations citing it; equal support keeps citation order. Duplicate claims do
+not increase support. This is a display heuristic, not a confidence score or a
+guarantee that the selected capture is the most relevant. Context-only and
+nonvisual evidence retain their basis and original event. All cited moments stay
+available, with exact recording links.
+
+Confidence, recovery and the first full evidence limitation remain visible when
+a finding opens. Exposure and remaining unique limits are one disclosure away;
+observation details retain each original claim and its specific limitation.
+This presentation does not rewrite the saved analysis or reviewer corrections.
+
 ## Durable records
 
 The frozen `humanish.observer-data.v1` schema is unchanged. A companion
@@ -103,9 +142,10 @@ status, usage and validated findings:
 .humanish/runs/<run>/
   analysis/<analysis>/analysis.json
   analysis/<analysis>/corrections/<correction>/correction.json
+  analysis-attempts/<analysis>/start.json  # before transport; outcome initially unknown
   analysis-attempts/<analysis>/receipt.json
   observer/study-analysis.json
-  analysis-automatic/job.json  # opt-in run lifecycle; never a retry instruction
+  analysis-automatic/job.json  # post-run lifecycle; never a retry instruction
 ```
 
 The optional automatic job is separate from the immutable analysis. Its view
@@ -120,6 +160,24 @@ model, budget, status and known usage even if source changes prevent report
 publication. They contain no question, participant text, images, or findings.
 `analyze list --json` includes these receipts.
 
+New requests first claim their execution directory and atomically publish
+`start.json` (`humanish.analysis-execution-start.v1`) before provider transport.
+It contains only the attempt/run IDs, input/config/source digests, prompt version
+and timestamp. The live caller retains a binding to that exact directory and
+publishes the final receipt once. A start without usable final accounting means
+dispatch and spend remain unresolved; it is not proof that a provider charged.
+A cancellation before transport can finalize with `usage.dispatched: false`.
+Admission refusals, missing credentials and rejected dispatch guards do not
+create a potentially paid attempt. Reuse does not create a new start.
+
+`humanish stats` reads all retained execution IDs, including failed, cancelled,
+unpriced and unresolved attempts. Report/receipt copies and automatic reuse
+count once per run and analysis ID. Legacy report usage can contribute without
+a fresh source or valid findings, but the missing execution receipt is labeled.
+This accounting read never approves findings or requests a provider. See
+[study cost statistics](study-costs.md) for the additive JSON contract and
+run-date attribution.
+
 Analysis and execution-history directories each admit 256 entries, including
 interrupted writes; correction history admits 256 entries per analysis. A new
 attempt requires readable inventories with room for its records before dispatch.

package/docs/contracts/study-costs.md

@@ -0,0 +1,69 @@
+# Study cost statistics
+
+`humanish stats` leads with the known estimated spend across the selected runs:
+participant and desktop estimates plus every distinct retained analysis attempt.
+It separates those components and shows missing usage and incomplete history.
+All amounts are estimates from retained rate-table accounting, not provider bills.
+
+```bash
+humanish stats
+humanish stats --lab sample-study --since 2026-09-01 --json
+```
+
+The filters select runs by lab and run start date. All later analysis reruns
+belong to their source run for filtering and daily grouping. This is study-cost
+attribution, not a calendar of provider charges.
+
+With no filters, a directory whose source metadata is unreadable can still
+contribute valid analysis receipts under `(no lab)` and `(undated)`. Lab/date
+filters exclude such unattributable directories; they remain named in
+`unreadable`. The command does not guess their date or lab from an analysis.
+
+## Additive JSON contract
+
+The envelope remains `humanish.stats.v1`. Existing fields keep their meanings:
+`totals.estimatedSpendUsd`, `days[].estimatedSpendUsd`, lab `medianCostUsd`,
+`costSamples` and `unpricedRuns` describe participant/desktop run estimates.
+They do not suddenly include a separate analysis request. The bundle's
+`cost.estimatedTotalUsd` and the cached run-index estimate also remain unchanged.
+Observer and terminal run summaries label this narrower scope.
+
+The new `costs` object appears on totals, each lab and each day. `costsByRun`
+contains the same accounting per selected run with stable warning codes.
+
+| Field | Meaning |
+| --- | --- |
+| `estimatedTotalUsd` | Sum of the retained run and analysis estimates |
+| `runEstimatedUsd` | Participant/desktop estimate; may be a known subtotal |
+| `analysisEstimatedUsd` | Sum of all distinct retained analysis estimates |
+| `incompleteRunEstimates` | Runs with partial or unknown participant/desktop accounting |
+| `analysisAttempts` | Distinct retained execution IDs, including unresolved claims |
+| `analysisDispatchedAttempts` | Attempts whose final accounting confirms transport |
+| `analysisNotDispatchedAttempts` | Attempts whose final accounting confirms no transport |
+| `analysisUnpricedAttempts` | Dispatched or potentially dispatched attempts without a complete price |
+| `analysisUnresolvedAttempts` | Claims without usable final accounting; a subset of unpriced attempts |
+| `analysisHistoryUncertainRuns` | Runs with absent, legacy report-only, unreadable or conflicting history |
+
+The three amount fields are `null` when nothing in that component has an
+estimate. Known zero is retained only when supported: for example, final
+accounting confirms an attempt never dispatched. A known subtotal can coexist
+with unknown costs; inspect the counts alongside it. An absent analysis history
+is not converted into a free analysis.
+
+## Accounting rules
+
+Execution receipts take part regardless of whether the analysis succeeded,
+its report was published, its findings are current, or the original recording
+later changed. The receipt and report with the same run/analysis ID count once;
+new IDs from explicit reruns count separately. Reusing a prior result adds no
+attempt or expense. Conflicting accounting for the same ID stays unresolved.
+
+Older reports without receipts contribute their strictly validated accounting
+metadata with a legacy warning. Provider requests that left no durable record
+in older versions cannot be reconstructed. A missing or corrupt inventory is
+explicitly uncertain. Reads are contained and bounded, and never dispatch,
+repair accounting, update timestamps or write files.
+
+The report covers retained study bundles only. It cannot account for separately
+launched preflight desktops, deleted runs, third-party application hosting,
+provider subscriptions, or spending outside the selected project directory.

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-15. Release baseline: `0.90.0`.
+Status date: 2026-09-15. Release baseline: `0.91.1`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.90.0-automatic-analysis.md).
+in the [release notes](../release/0.91.1-study-review-polish.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.90.0`)
+## Current Program Truth (source `0.91.1`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -99,7 +99,7 @@ substitute for it.
 | Shared state | Sequential and concurrent single-origin shared-world studies with retained evidence | Multi-origin implementation remains gated; concurrent state change does not establish per-action causation |
 | Observer | Live/recorded views, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
 | Review and feedback | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication |
-| Study findings | Explicit `analyze` or opt-in post-run analysis, bounded evidence selection, versioned findings, exact source links and append-only corrections within the Observer study shell | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
+| Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
 | TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving and run library | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |
 | Off-app communication | In-sandbox email/SMS catch and digest-only thread evidence | This does not establish real-provider delivery |
 | Mobile and media | Hosted viewport/emulation, desktop geometry checks, bounded dwell and declared camera feed | Physical-device and touch fidelity remain unproven; unsupported microphone declarations are rejected |

package/docs/principles/invariants-and-defaults.md

@@ -34,9 +34,12 @@ certify (see the conformance suite).
    terminal) is only ever pointed at a URL the harness itself issued or validated under a
    declared policy (loopback entry, provisioned subject, declared external target). Never an
    arbitrary URL from unvalidated input.
-3. **Live spend is explicit.** No configuration default, omission, or fallback may cause
-   provider or sandbox spend. Spend requires an affirmative declaration (`scenario.mode:
-   live`, an env opt-in gate for spend-bearing tests).
+3. **Live spend requires an explicit live invocation.** No omission or fallback may
+   turn a dry run, preview, reader or unsupported route into provider or sandbox
+   spend. An explicitly live supported study includes the disclosed default
+   post-run analysis budget unless `review.analysis: false` disables it. Analysis
+   has a separate admission estimate limit, not a provider billing cap or part of
+   the actor budget. Spend-bearing tests retain their explicit env gates.
 4. **Evidence verifies fail-closed.** A run bundle that cannot pass verification (schema,
    redaction status, artifact presence, public-safety scan) is a failed run, even when the
    session "worked." The gate applies to the harness's own error reports.
@@ -82,6 +85,7 @@ silently drifting from one is not.
 | Default | Why it is the default | Legitimate override |
 |---|---|---|
 | Dry-run | Spend safety (invariant 3 sets the floor; dry-run keeps the floor far away) | `scenario.mode: live` |
+| Post-run analysis on supported live studies | Findings accompany the recording; a separate $3 admission estimate limit is visible before execution | `review.analysis: false` disables it; an explicit mapping sets another analysis budget. Dry-run and unsupported routes never dispatch; missing default credentials produce a recorded skip |
 | Per-lane worlds | Isolation, attribution, reproducibility | `subject.topology: shared-world` — N seats against ONE provisioned, mutable plane for scenarios that ARE about interaction between roles (#164). `execution.concurrency: 1` (an explicit choice) = SEQUENTIAL turns (one sandbox); higher = CONCURRENT — and since #350 an omitted concurrency fills to the seat count, so every declared seat runs live at once by default (one getHost-exposed subject sandbox + N actor sandboxes driving it at once, synthetic-subject only). The bundle declares the weaker `attributionClass: shared-world` + a verify-enforced `attributionLimits` ceiling (the concurrent set drops `sequential-only` and adds `best-effort-causal-attribution` etc.), so the looser per-role attribution is honest, not hidden. |
 | External key placement | Smallest blast radius: when the keyed process (e.g. a computer-use provider loop) runs outside the sandbox, its key never enters | In-sandbox placement when the keyed process runs inside (an agent harness under test); declared per actor type, with a spend budget |
 | Loopback entry URLs | Public-safety: never drive third-party sites unbidden | `policies.allowPublicTargets` for an owner-declared deployment/preview (a Vercel preview of your own app). Multi-lane public/preview fan-out needs explicit `actors[0].lanes[].target` for every lane, so the adapter-owned topology is declared rather than inferred. Provisioned clone subjects always serve in-sandbox on loopback |

package/docs/product/automatic-analysis.md

@@ -1,8 +1,11 @@
 # Automatic study analysis
 
-A lab can request analysis after each live recording finishes. Findings remain
+Supported live studies automatically request analysis after each recording finishes. Findings remain
 separate from participant feedback and the recorded study verdict.
 
+The default is `gpt-6-astra` with high reasoning effort, a separate $3 admission
+estimate limit, a 300-second timeout and 16,384 output tokens. To customize it:
+
 ```yaml
 review:
   analysis:
@@ -14,26 +17,37 @@ review:
     # question: Where did participants need to recover?
 ```
 
-Omit `review.analysis` to leave the existing run behavior unchanged. The budget
-is required when analysis is present. It limits an admission estimate, not the
+Omitting `review.analysis` uses these defaults. Set `review.analysis: false` to
+run participants without the additional analysis request. An explicit analysis
+mapping requires `maxCostUsd`. This limits an admission estimate, not the
 provider's final bill, and is separate from participant spending limits. Analysis
 sends selected retained text and captures to OpenAI using `OPENAI_API_KEY`.
 Analysis runs in the Humanish runner using its credentials. This setting adds no
 credential channel to the target application; each participant backend retains
-its existing authentication boundary. Review a manifest's opt-in before running
-it live.
+its existing authentication boundary. Review the separate analysis budget before running a manifest live; an actor's
+zero-dollar cap does not cap post-run analysis. The bundled first-contact
+zero-spend product fixture explicitly disables analysis.
 
 The same configuration works through `humanish run <lab>`, `lab run <lab>`,
 `watch <lab>`, and TUI live starts. Direct library calls to the five recording
 producers honor it too. Supported routes are computer-use, scripted-browser,
 terminal-product, sequential shared-world and concurrent shared-world. Synthetic,
-smoke and meta routes reject the setting before execution. Dry runs show analysis
+smoke and meta routes never enable analysis by default and reject an explicit
+analysis mapping before execution. `false` is accepted on every route. Dry runs show analysis
 as skipped, without reading analysis credentials or making a provider request.
 
 Participant execution finishes and its recording is finalized before analysis is
 queued. A participant who was blocked or interrupted can still have useful
 retained evidence; analysis requires a verified live recording, not a successful
 participant outcome. An active, missing or invalid recording is not analyzed.
+Default analysis also skips recordings containing only setup or failure records
+with no retained participant activity. A desktop startup failure does not start
+an analysis request. The original failure remains visible.
+
+CLI live starts disclose the separate admission estimate limit before execution.
+`humanish lab preflight <lab> --json` and the TUI lab screen also expose the
+resolved budget without dispatching analysis. Library callers can inspect
+`resolveAutomaticAnalysis` or `automaticAnalysisBudget` before running.
 
 The command waits for analysis and reports its separate state. A TUI-launched
 runner continues after the TUI closes; reopening the TUI or Observer reads the
@@ -54,7 +68,11 @@ accepted. Known usage is retained; missing usage remains unknown.
 
 The CLI's JSON keeps `runOk` for the original backend result, `automaticAnalysis`
 for post-run analysis, and `ok` for the overall request. Failed, cancelled or
-unknown analysis produces exit code 2 without discarding the recording. Partial
+unknown analysis produces exit code 2 without discarding the recording. A missing
+`OPENAI_API_KEY` skips default analysis and preserves a successful run exit;
+`automaticAnalysisTrigger: "default"` distinguishes that case in JSON. A missing
+key for an explicitly configured analysis remains a failed overall request.
+Either skip is retained for review and does not retry automatically. Partial
 findings remain visibly partial; a valid partial result can succeed, while a
 partial result with an analysis error still fails the command. Recorded task
 outcomes and the deterministic review verdict are never rewritten by analysis.

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.90.0` (2026-09-15). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.91.1` (2026-09-15). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,15 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.91.1 release note](../release/0.91.1-study-review-polish.md) describes
+retained analysis costs in study totals, finding previews and caveats, final
+active-page viewport measurements, and corrected setup guidance.
+
+The [0.91.0 release note](../release/0.91.0-analysis-quality-and-defaults.md)
+describes automatic analysis by default on supported live recordings, its
+separate disclosed budget and opt-out, fairer evidence selection, and
+evidence-linked review of material concerns and exclusions.
+
 The [0.90.0 release note](../release/0.90.0-automatic-analysis.md) describes
 opt-in analysis after live runs, truthful job states, cancellation, and scripted
 captures and assignments in findings and playback.
@@ -99,7 +108,7 @@ Implemented:
 
 - `commander` CLI with stable command help;
 - `init`, `doctor`, `run`, `watch`, `verify`, `review`, `runs`, `analyze`, and `feedback`;
-- opt-in study analysis with bounded provider admission, immutable findings,
+- study analysis with bounded provider admission, a live-run default and opt-out, immutable findings,
   source-bound corrections and evidence-linked Observer review;
 - synthetic run bundles;
 - public-safety verification with machine-readable `shareSafety.status`

package/docs/release/0.91.0-analysis-quality-and-defaults.md

@@ -0,0 +1,33 @@
+# Humanish 0.91.0
+
+Supported live studies now request analysis when the recording finishes, using
+`gpt-6-astra` with high reasoning and a separate $3 admission estimate limit.
+The CLI, preflight and TUI disclose that budget. Set `review.analysis: false` to
+disable the extra request, or supply an analysis mapping with `maxCostUsd` to
+customize it. The estimate is additional to participant and desktop costs and
+is not a provider billing cap. Missing default credentials record a skip while
+preserving a successful recording; explicit analysis failures remain failures.
+Startup failures with no retained participant activity skip default analysis.
+
+Analysis now reviews material participant concerns before ranking findings.
+Useful reported uncertainty and recovered mistakes can remain findings even
+when product fault is unproven. **Concerns considered** shows evidence-linked
+decisions, including why material concerns were left out of the ranked list.
+It is model assessment, separate from original participant feedback and human
+reviewer annotations.
+
+Evidence selection shares count and text budgets across participants and samples
+their whole sessions, prioritizing beginnings, endings and context around
+recorded failures. Original frame and event identities remain intact. Missing
+assignments remain explicit; historical assignments are never invented.
+Existing analysis versions remain readable and unchanged.
+
+Selection is bounded and can still omit important moments. Concern review does
+not certify exhaustive discovery or accurate causal diagnosis. Opening Observer,
+exporting a recording and reading history never start a model request. Dry-runs
+and unsupported default routes remain request-free, and examples advertised as
+zero-spend explicitly disable automatic analysis.
+
+See the [analysis contract](../contracts/study-analysis.md),
+[automatic analysis guide](../product/automatic-analysis.md), and
+[bounded evaluation receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/analysis-quality-and-defaults-2026-09-15.md).

package/docs/release/0.91.1-study-review-polish.md

@@ -0,0 +1,28 @@
+# Humanish 0.91.1
+
+Study cost summaries include retained analysis attempts alongside participant
+and desktop estimates. Reusing a saved analysis does not add another charge;
+separate retries do. Missing prices and incomplete histories remain explicit.
+The existing stats JSON fields keep their original participant-and-desktop
+meaning; additive cost fields provide the combined retained estimate.
+
+Finding previews prefer directly cited visual evidence over nearby context
+captures. Selection is deterministic, but does not establish that the chosen
+image is the best illustration of an issue. Exact source links and reviewer
+corrections remain available.
+
+Report qualifications are easier to scan, with the full limitations available
+through a disclosure. This changes presentation without changing saved analysis
+or participant feedback.
+
+Final hosted Chromium geometry follows the active page after tab changes.
+Valid CSS viewport measurements survive missing page-reported outer-window
+bounds. Missing measurements remain missing; physical screen dimensions never
+substitute for the page viewport.
+
+The own-app guide now describes the hosted reachability probe and its desktop
+cost. Starter comments document the existing opt-in mobile emulation settings.
+
+See the [cost accounting contract](../contracts/study-costs.md) and the
+[verification receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/study-review-polish-2026-09-15.md)
+for the methods and limits of these checks.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.90.0",
+  "version": "0.91.1",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [