humanish 0.91.0 → 0.92.0

package/docs/contracts/run-bundle.md

@@ -210,6 +210,10 @@ bundles stay byte-stable. Each lane's own estimate also rides its
 from the reserved provider-returned `tokenUsage.costUsd`. See
 [`schemas.md`](schemas.md) → Run Cost Summary And Estimated Actor Cost.
 
+This bundle subtotal excludes separate study-analysis requests. Use
+`humanish stats` for the complete retained estimate and explicit accounting
+gaps across run costs and analysis attempts. See [study cost statistics](study-costs.md).
+
 `humanish verify` treats cost as ADVISORY on magnitude and FAIL-CLOSED on
 labeling: absence passes, but a claimed dollar figure without its `ratesAsOf`
 date + `source`, or a total that does not match its known lines, fails. Verify

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.91.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.92.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.
@@ -41,6 +41,7 @@ workflow without leaking private upstream truth into core.
 | Study analysis | `humanish.study-analysis.v1` | see [study analysis](study-analysis.md) and synthetic analysis fixtures in `tests/` |
 | Study analysis correction | `humanish.study-analysis-correction.v1` | see [study analysis](study-analysis.md#human-review-and-sharing) |
 | Analysis execution receipt | `humanish.analysis-execution.v1` | see [study analysis](study-analysis.md#durable-records) |
+| Analysis execution start | `humanish.analysis-execution-start.v1` | see [study analysis](study-analysis.md#durable-records) |
 | Verification | `humanish.verify-result.v1` | `five-check-verify` |
 | Policy | `humanish.policy.v1` (fixture-only; not engine-validated) | `public-safety-policy` |
 | Feedback | `humanish.feedback.v1` | `public-safe-feedback` |

package/docs/contracts/study-analysis.md

@@ -118,6 +118,19 @@ offset. Nonvisual events retain event identity without invented frame offsets.
 Scripted captures without recorded timestamps keep null analysis times; any
 uniform playback pacing is an estimate, not an observed duration.
 
+Finding previews select from the finding's cited entries. They prefer a capture
+directly cited as visual evidence, then the number of distinct visual/action
+observations citing it; equal support keeps citation order. Duplicate claims do
+not increase support. This is a display heuristic, not a confidence score or a
+guarantee that the selected capture is the most relevant. Context-only and
+nonvisual evidence retain their basis and original event. All cited moments stay
+available, with exact recording links.
+
+Confidence, recovery and the first full evidence limitation remain visible when
+a finding opens. Exposure and remaining unique limits are one disclosure away;
+observation details retain each original claim and its specific limitation.
+This presentation does not rewrite the saved analysis or reviewer corrections.
+
 ## Durable records
 
 The frozen `humanish.observer-data.v1` schema is unchanged. A companion
@@ -129,6 +142,7 @@ status, usage and validated findings:
 .humanish/runs/<run>/
   analysis/<analysis>/analysis.json
   analysis/<analysis>/corrections/<correction>/correction.json
+  analysis-attempts/<analysis>/start.json  # before transport; outcome initially unknown
   analysis-attempts/<analysis>/receipt.json
   observer/study-analysis.json
   analysis-automatic/job.json  # post-run lifecycle; never a retry instruction
@@ -146,6 +160,24 @@ model, budget, status and known usage even if source changes prevent report
 publication. They contain no question, participant text, images, or findings.
 `analyze list --json` includes these receipts.
 
+New requests first claim their execution directory and atomically publish
+`start.json` (`humanish.analysis-execution-start.v1`) before provider transport.
+It contains only the attempt/run IDs, input/config/source digests, prompt version
+and timestamp. The live caller retains a binding to that exact directory and
+publishes the final receipt once. A start without usable final accounting means
+dispatch and spend remain unresolved; it is not proof that a provider charged.
+A cancellation before transport can finalize with `usage.dispatched: false`.
+Admission refusals, missing credentials and rejected dispatch guards do not
+create a potentially paid attempt. Reuse does not create a new start.
+
+`humanish stats` reads all retained execution IDs, including failed, cancelled,
+unpriced and unresolved attempts. Report/receipt copies and automatic reuse
+count once per run and analysis ID. Legacy report usage can contribute without
+a fresh source or valid findings, but the missing execution receipt is labeled.
+This accounting read never approves findings or requests a provider. See
+[study cost statistics](study-costs.md) for the additive JSON contract and
+run-date attribution.
+
 Analysis and execution-history directories each admit 256 entries, including
 interrupted writes; correction history admits 256 entries per analysis. A new
 attempt requires readable inventories with room for its records before dispatch.

package/docs/contracts/study-costs.md

@@ -0,0 +1,69 @@
+# Study cost statistics
+
+`humanish stats` leads with the known estimated spend across the selected runs:
+participant and desktop estimates plus every distinct retained analysis attempt.
+It separates those components and shows missing usage and incomplete history.
+All amounts are estimates from retained rate-table accounting, not provider bills.
+
+```bash
+humanish stats
+humanish stats --lab sample-study --since 2026-09-01 --json
+```
+
+The filters select runs by lab and run start date. All later analysis reruns
+belong to their source run for filtering and daily grouping. This is study-cost
+attribution, not a calendar of provider charges.
+
+With no filters, a directory whose source metadata is unreadable can still
+contribute valid analysis receipts under `(no lab)` and `(undated)`. Lab/date
+filters exclude such unattributable directories; they remain named in
+`unreadable`. The command does not guess their date or lab from an analysis.
+
+## Additive JSON contract
+
+The envelope remains `humanish.stats.v1`. Existing fields keep their meanings:
+`totals.estimatedSpendUsd`, `days[].estimatedSpendUsd`, lab `medianCostUsd`,
+`costSamples` and `unpricedRuns` describe participant/desktop run estimates.
+They do not suddenly include a separate analysis request. The bundle's
+`cost.estimatedTotalUsd` and the cached run-index estimate also remain unchanged.
+Observer and terminal run summaries label this narrower scope.
+
+The new `costs` object appears on totals, each lab and each day. `costsByRun`
+contains the same accounting per selected run with stable warning codes.
+
+| Field | Meaning |
+| --- | --- |
+| `estimatedTotalUsd` | Sum of the retained run and analysis estimates |
+| `runEstimatedUsd` | Participant/desktop estimate; may be a known subtotal |
+| `analysisEstimatedUsd` | Sum of all distinct retained analysis estimates |
+| `incompleteRunEstimates` | Runs with partial or unknown participant/desktop accounting |
+| `analysisAttempts` | Distinct retained execution IDs, including unresolved claims |
+| `analysisDispatchedAttempts` | Attempts whose final accounting confirms transport |
+| `analysisNotDispatchedAttempts` | Attempts whose final accounting confirms no transport |
+| `analysisUnpricedAttempts` | Dispatched or potentially dispatched attempts without a complete price |
+| `analysisUnresolvedAttempts` | Claims without usable final accounting; a subset of unpriced attempts |
+| `analysisHistoryUncertainRuns` | Runs with absent, legacy report-only, unreadable or conflicting history |
+
+The three amount fields are `null` when nothing in that component has an
+estimate. Known zero is retained only when supported: for example, final
+accounting confirms an attempt never dispatched. A known subtotal can coexist
+with unknown costs; inspect the counts alongside it. An absent analysis history
+is not converted into a free analysis.
+
+## Accounting rules
+
+Execution receipts take part regardless of whether the analysis succeeded,
+its report was published, its findings are current, or the original recording
+later changed. The receipt and report with the same run/analysis ID count once;
+new IDs from explicit reruns count separately. Reusing a prior result adds no
+attempt or expense. Conflicting accounting for the same ID stays unresolved.
+
+Older reports without receipts contribute their strictly validated accounting
+metadata with a legacy warning. Provider requests that left no durable record
+in older versions cannot be reconstructed. A missing or corrupt inventory is
+explicitly uncertain. Reads are contained and bounded, and never dispatch,
+repair accounting, update timestamps or write files.
+
+The report covers retained study bundles only. It cannot account for separately
+launched preflight desktops, deleted runs, third-party application hosting,
+provider subscriptions, or spending outside the selected project directory.

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-15. Release baseline: `0.91.0`.
+Status date: 2026-09-17. Release baseline: `0.92.0`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.91.0-analysis-quality-and-defaults.md).
+in the [release notes](../release/0.92.0-grid-playback.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.91.0`)
+## Current Program Truth (source `0.92.0`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -97,7 +97,7 @@ substitute for it.
 | Subjects | `this-repo`, `clone`, `app-url`, `local-app`, `terminal-product`, `desktop-cli`, `local-tree` | `this-repo` is dry-run-only; `local-app` needs a caller-supplied executor/provider |
 | Task protocol | Hidden criteria and per-task outcomes on supported per-lane CUA paths, including local-agent and desktop-cli | Shared-world, terminal-product, scripted and synthetic routes reject `tasks` before execution |
 | Shared state | Sequential and concurrent single-origin shared-world studies with retained evidence | Multi-origin implementation remains gated; concurrent state change does not establish per-action causation |
-| Observer | Live/recorded views, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
+| Observer | Live/recorded views, whole-grid playback, participant assignments, action-specific links, saved moments, zoom, comparison and phone-width review | Sparse captures cannot prove every action's effect; visual comparison alone is not a controlled experiment |
 | Review and feedback | Verification grades, feedback drafts, portable HTML, redacted bundle derivatives and computer-use completion-source labels | Sharing requires the appropriate grade; participant reports and condition matches still need task adjudication |
 | Study findings | Default post-run analysis on supported live routes with a separate disclosed $3 admission estimate limit and opt-out; explicit `analyze`, fairer evidence selection, concern review and versioned findings with exact source links | Model interpretation needs review; bounded selection and source truncation limit coverage; opening Observer never dispatches analysis |
 | TUI and serving | Detached starts, run stopping, reclamation, Observer attachment, loopback serving and run library | Stopping a process does not itself prove sandbox cleanup; TUI views over CLI `stats`/`export` remain follow-ups |

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.91.0` (2026-09-15). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.92.0` (2026-09-17). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -47,6 +47,14 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.92.0 release note](../release/0.92.0-grid-playback.md) describes
+whole-grid recording playback, capture-time scrubbing, explicit coverage gaps,
+and returning from an individual frame to the same paused grid.
+
+The [0.91.1 release note](../release/0.91.1-study-review-polish.md) describes
+retained analysis costs in study totals, finding previews and caveats, final
+active-page viewport measurements, and corrected setup guidance.
+
 The [0.91.0 release note](../release/0.91.0-analysis-quality-and-defaults.md)
 describes automatic analysis by default on supported live recordings, its
 separate disclosed budget and opt-out, fairer evidence selection, and

package/docs/release/0.91.1-study-review-polish.md

@@ -0,0 +1,28 @@
+# Humanish 0.91.1
+
+Study cost summaries include retained analysis attempts alongside participant
+and desktop estimates. Reusing a saved analysis does not add another charge;
+separate retries do. Missing prices and incomplete histories remain explicit.
+The existing stats JSON fields keep their original participant-and-desktop
+meaning; additive cost fields provide the combined retained estimate.
+
+Finding previews prefer directly cited visual evidence over nearby context
+captures. Selection is deterministic, but does not establish that the chosen
+image is the best illustration of an issue. Exact source links and reviewer
+corrections remain available.
+
+Report qualifications are easier to scan, with the full limitations available
+through a disclosure. This changes presentation without changing saved analysis
+or participant feedback.
+
+Final hosted Chromium geometry follows the active page after tab changes.
+Valid CSS viewport measurements survive missing page-reported outer-window
+bounds. Missing measurements remain missing; physical screen dimensions never
+substitute for the page viewport.
+
+The own-app guide now describes the hosted reachability probe and its desktop
+cost. Starter comments document the existing opt-in mobile emulation settings.
+
+See the [cost accounting contract](../contracts/study-costs.md) and the
+[verification receipt](https://github.com/danielgwilson/humanish/blob/main/docs/goals/computer-use-actor/receipts/study-review-polish-2026-09-15.md)
+for the methods and limits of these checks.

package/docs/release/0.92.0-grid-playback.md

@@ -0,0 +1,22 @@
+# Humanish 0.92.0
+
+Play and scrub all recorded participants together in the Observer grid.
+The transport includes pause, playback speed and a shared recording timeline.
+Opening a displayed capture lands on its exact frame; returning restores the
+grid's time and participant page, paused.
+
+Playback follows recorded capture timestamps across the whole study, preserving
+staggered coverage regardless of filters or page selection. Each screen holds
+until its next capture, with its age visible. Missing timestamps and absent
+captures remain explicit; each participant's individual evidence stays available.
+Recorded timestamps can differ between producers, and a held image cannot show
+what happened between captures.
+
+The grid initially retains its latest previews. Playing or seeking enters
+recorded review and removes live desktop previews. Use **Follow live** or
+**Latest captures** to return. New evidence extends the timeline without moving
+a paused cursor. If refreshed evidence no longer covers that cursor, Observer
+explains the gap and lets the reviewer choose a new time.
+
+Playback works with self-contained HTML exports and existing recorded bundles.
+It runs locally in the viewer and does not start participants or analysis.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.91.0",
+  "version": "0.92.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [