humanish 0.96.0 → 0.97.0

package/dist/cua-actor-lab.js

@@ -1,7 +1,11 @@
-import { withTransientCommsSecrets } from "./run-narration-secrets.js";
+export { inboxRecipientFor, laneHasInboxRecipient } from "./cua-desktop-lane.js";
+export { CUA_ACTOR_LAB_PROVIDER_METADATA, DEFAULT_MOBILE_USER_AGENT, SANDBOX_CAMERA_PATH, SANDBOX_MEDIA_DIR, SUBJECT_DIR, SYNTHETIC_CAMERA_COMMAND, applyMobileEmulation, buildFillDesktopWindowCommand, captureDesktopBrowserGeometry, commandDigestOf, declaredScreenForRender, desktopBrowserFamily, inspectDesktopScreenGeometry, makeChromeBrowserStateObserver, makeChromeDesktopGeometryObserver, parseXwininfoGeometry, prepareDesktopMedia, provisionCloneSubject, provisionLocalTreeSubject } from "./e2b-cua-provisioning.js";
 import { prepareReceivingRun, receivingPublication } from "./comms-receiving-runtime.js";
-import { deployReceivingInbox } from "./comms-receiving-inbox.js";
+import { laneHasInboxRecipient } from "./cua-desktop-lane.js";
+import { createE2BCuaDesktopLane } from "./e2b-cua-desktop.js";
+import { DEFAULT_STATE_STEP_TIMEOUT_MS, commandDigestOf, declaredScreenForRender } from "./e2b-cua-provisioning.js";
 import { receivingEmailValidationReason } from "./lab-config.js";
+import { withTransientCommsSecrets } from "./run-narration-secrets.js";
 // The computer-use lab backend: a subject (an app-url the caller provisioned, or a repo the
 // lab clones AND serves in-sandbox) driven by a REGISTRY-RESOLVED computer-use actor inside a
 // hosted E2B desktop. This is the path that makes `actors[].type` load-bearing — the
@@ -24,52 +28,47 @@ import { receivingEmailValidationReason } from "./lab-config.js";
 //   harness errors are redacted at THIS boundary; the bundle's `stream.actor` carries the
 //   conformant humanish.actor-trace.v1 projection, whose `redaction.screenshots` records the
 //   run's actual mode ("raw" | "blurred" | "n/a") — every label downstream derives from it.
-import { resolveAutomaticAnalysis } from "./automatic-analysis-config.js";
-import { completeAutomaticAnalysis, markFinalizedStudyResult } from "./automatic-analysis-completion.js";
-import { desktopMediaValidationReason, taskProtocolValidationReason } from "./lab-config.js";
 import { randomBytes } from "node:crypto";
-import { describeMissingKeys } from "./key-resolution.js";
 import { readFile, realpath, rm } from "node:fs/promises";
 import path from "node:path";
+import { completeAutomaticAnalysis, markFinalizedStudyResult } from "./automatic-analysis-completion.js";
+import { resolveAutomaticAnalysis } from "./automatic-analysis-config.js";
+import { describeMissingKeys } from "./key-resolution.js";
+import { desktopMediaValidationReason, taskProtocolValidationReason } from "./lab-config.js";
+import { pathToFileURL } from "node:url";
+import { toErrorMessage } from "./command-failure.js";
 import { cuaLaneDiagnostics, summarizeCuaDiagnostics } from "./cua-diagnostics.js";
 import { feedbackProofCommands } from "./feedback-proof.js";
-import { runDesktopCommandOrThrow, toErrorMessage } from "./command-failure.js";
-import { pathToFileURL } from "node:url";
-import { beginRunStatus, withRunStatusScope } from "./run-status.js";
-import { adapterScoreFailureMessage, applyBrowserAdapterHooks } from "./adapter-extension.js";
 import { actorRegistry, isCuaActorDescriptor } from "./actor-registry.js";
-import { CHROMIUM_EVIDENCE_HYGIENE_FLAGS, chromiumEvidenceProfilePreferencesJson } from "./browser-evidence-hygiene.js";
-import { DEFAULT_OPENAI_CU_MODEL } from "./openai-responses-cu.js";
-import { createLocalAgentProvider, detectLocalAgents } from "./local-agent-cli.js";
-import { startAppServerSession } from "./local-agent-appserver.js";
-import { startClaudeSession } from "./local-agent-claude-session.js";
-import { createDesktopSandbox, withOneRetryOnTransientE2BError, loadE2BDesktopModule } from "./e2b-desktop-launch.js";
-import { probeUrl, readDetachedLog, runDetachedStep, startDetachedProcess } from "./e2b-detached.js";
-import { DEFAULT_SANDBOX_CATCH_PORT, collectCommsThread, collectExternalCommsThread, deployCommsCatch, externalCatchHealthy, externalInboxUrl, refreshInboxSurface, writeInboxSurface } from "./comms-sandbox-catch.js";
+import { actorEnding } from "./actor-stop-cause.js";
+import { adapterScoreFailureMessage, applyBrowserAdapterHooks } from "./adapter-extension.js";
 import { FakeInbox } from "./comms-fake-inbox.js";
-import { buildOriginMap, recipientInboxUrl } from "./comms-inbox.js";
-import { DEFAULT_DEVICE_PRESET, isDevicePresetName, resolveDevicePreset } from "./device-presets.js";
-import { cuaLaneValidationReason, outputTokenLimitValidationReason, isHttpUrl, isLoopbackUrl, MAX_CUA_LANES, subjectStateInvalidReason } from "./lab-config.js";
+import { recipientInboxUrl } from "./comms-inbox.js";
+import { collectExternalCommsThread, externalCatchHealthy, externalInboxUrl } from "./comms-sandbox-catch.js";
 import { mapWithConcurrency } from "./concurrency.js";
-import { appendSandboxReceipt } from "./sandbox-receipts.js";
+import { DEFAULT_DEVICE_PRESET, isDevicePresetName, resolveDevicePreset } from "./device-presets.js";
+import {} from "./e2b-desktop-launch.js";
+import {} from "./e2b-desktop-resources.js";
+import {} from "./e2b-detached.js";
 import { assertScreenshotEvidence } from "./image-evidence.js";
+import { MAX_CUA_LANES, cuaLaneValidationReason, isHttpUrl, isLoopbackUrl, outputTokenLimitValidationReason, subjectStateInvalidReason } from "./lab-config.js";
+import { startAppServerSession } from "./local-agent-appserver.js";
+import { startClaudeSession } from "./local-agent-claude-session.js";
+import { createLocalAgentProvider, detectLocalAgents } from "./local-agent-cli.js";
 import { buildObserverData } from "./observer-data.js";
-import { corepackCommandFor, needsNodeRuntime, nodeBootstrapCommand } from "./subject-runtime.js";
-import { TERMINAL_NODE_BOOTSTRAP_COMMAND } from "./terminal-node-bootstrap.js";
-import { chromeCdpProbeCommand, parseChromeCdpProbeOutput } from "./chrome-cdp-probe.js";
-import { personaToDirectives, renderPersonaPromptSection } from "./persona.js";
-import { labPersonaIds, resolveCommittedPersonas } from "./persona-resolve.js";
-import { renderTaskPrompt } from "./tasks.js";
 import { attachObserverRuntimeStreamUrls, renderObserver } from "./observer.js";
-import { containsSensitive, digestText, redactedTail, redactText } from "./redaction.js";
+import { DEFAULT_OPENAI_CU_MODEL } from "./openai-responses-cu.js";
 import { participantAssignment } from "./participant-assignment.js";
-import { actorEnding } from "./actor-stop-cause.js";
-import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputDirectory, prepareSelectedOutputDirectory, writeContainedOutputFile, writePreparedRunLatestPointer } from "./selected-output-paths.js";
+import { labPersonaIds, resolveCommittedPersonas } from "./persona-resolve.js";
+import { personaToDirectives, renderPersonaPromptSection } from "./persona.js";
+import { MODEL_RATES, estimateActorCost, estimateAllocatedDesktopCost, estimateDesktopCost, round6 } from "./pricing.js";
+import { containsSensitive, digestText, redactText } from "./redaction.js";
 import { prepareRunArtifactPaths, validatePreparedRunArtifactPaths } from "./run-paths.js";
+import { beginRunStatus, withRunStatusScope } from "./run-status.js";
+import { PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA, aggregateTaskFunnels, buildRunSource, formatParticipantOutcomes, formatStudyTaskFunnel, loadRunBundle, tallyParticipantOutcomes, withCuaReviewProvenance } from "./run.js";
+import { assertPreparedSelectedOutputDirectory, assertSafeOutputPathSegment, prepareContainedOutputDirectory, prepareSelectedOutputDirectory, writeContainedOutputFile, writePreparedRunLatestPointer } from "./selected-output-paths.js";
 import { createLocalTreeArchive } from "./source-archive.js";
-import { buildRunSource, loadRunBundle, PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA, aggregateTaskFunnels, formatParticipantOutcomes, formatStudyTaskFunnel, tallyParticipantOutcomes, withCuaReviewProvenance } from "./run.js";
-import { estimateActorCost, estimateDesktopCost, estimateAllocatedDesktopCost, MODEL_RATES, round6 } from "./pricing.js";
-import { observeDesktopResources } from "./e2b-desktop-resources.js";
+import { renderTaskPrompt } from "./tasks.js";
 export const CUA_ACTOR_LAB_SCHEMA = "humanish.cua-lab-result.v2";
 // The only fan-out topology this slice ships: N lanes = N independent E2B desktop sandboxes,
 // each its own world (clone/serve + subject.state per lane). Shared-world is layer 7 (#164).
@@ -77,10 +76,6 @@ export const CUA_FANOUT_STRATEGY = "per-lane-worlds";
 // Env override that may only LOWER the effective concurrency (never raise concurrent paid
 // desktops — invariant 3). Read names-only into a local; the value never persists.
 const CUA_MAX_CONCURRENCY_ENV = "HUMANISH_CUA_MAX_CONCURRENCY";
-export const CUA_ACTOR_LAB_PROVIDER_METADATA = {
-    mode: "cua-actor-lab",
-    tool: "humanish"
-};
 // The DEFAULT session budget, sized so a study can FINISH (docs/principles/three-roles.md: a
 // session ends because the participant is done, not because a timer fired — the time-box is a
 // session-level cap a researcher sets generously; spend protection is the dollar caps' job).
@@ -103,60 +98,6 @@ function defaultSessionTimeoutMs(config) {
     const room = MAX_SANDBOX_MS - SUBJECT_PROVISION_BUDGET_MS - stateBudgetMs - SANDBOX_TIMEOUT_BUFFER_MS;
     return Math.max(MIN_DERIVED_SESSION_TIMEOUT_MS, Math.min(DEFAULT_APP_URL_SESSION_TIMEOUT_MS, room));
 }
-// Settle after opening the browser, before the first screenshot — long enough for a cold
-// browser + page load to paint (2s captured a blank desktop; the render empirically needs ~6-9s).
-const BROWSER_SETTLE_MS = 8_000;
-/** Where a lane's synthetic camera feed lives inside the sandbox: a tmpfs the sandbox user can
- *  write, and a path that contains neither /tmp/ nor /home/, which the public-safety scan reads
- *  as an operator's local path (this one is the harness's own and belongs in the bundle). */
-export const SANDBOX_MEDIA_DIR = "/dev/shm/humanish-media";
-export const SANDBOX_CAMERA_PATH = `${SANDBOX_MEDIA_DIR}/camera.y4m`;
-/** The synthetic feed: ffmpeg's test pattern, 640x480 at 10 fps, six seconds (about 28 MB of
- *  raw Y4M on the tmpfs), looped by Chrome's fake capture device. */
-export const SYNTHETIC_CAMERA_COMMAND = `mkdir -p ${SANDBOX_MEDIA_DIR} && ffmpeg -y -loglevel error -f lavfi -i testsrc=size=640x480:rate=10 -t 6 -pix_fmt yuv420p ${SANDBOX_CAMERA_PATH}`;
-/**
- * Put the declared camera feed in the sandbox and return the Chromium flags that present it as a
- * capture device (#509). Fails CLOSED: a feed that cannot be produced (no ffmpeg on the image, an
- * unreadable host file) is named before the browser launches, because a participant told it has
- * a camera and finds none reports the instrument's gap as the product's.
- */
-export async function prepareDesktopMedia(desktop, media, permission, cwd, requestTimeoutMs, readHostFile = (absolutePath) => readFile(absolutePath)) {
-    if (media.microphone !== undefined) {
-        throw new Error("execution.desktop.media.microphone.source injection is unsupported; the declared microphone file cannot be delivered, including on custom templates.");
-    }
-    const flags = [];
-    let camera;
-    if (media.camera !== undefined) {
-        if (media.camera.source === "synthetic") {
-            const made = await desktop.commands.run(SYNTHETIC_CAMERA_COMMAND, { requestTimeoutMs, timeoutMs: 60_000 });
-            if (made.exitCode !== undefined && made.exitCode !== 0) {
-                throw new Error(`the synthetic camera feed could not be generated on this desktop image (ffmpeg exited ${made.exitCode}: ${tailOf(made.stderr ?? made.stdout ?? "")}); give execution.desktop.media.camera.source a .y4m file instead`);
-            }
-            camera = { source: "synthetic", file: SANDBOX_CAMERA_PATH };
-        }
-        else {
-            const absolutePath = path.resolve(cwd, media.camera.source);
-            let bytes;
-            try {
-                bytes = await readHostFile(absolutePath);
-            }
-            catch (error) {
-                throw new Error(`execution.desktop.media.camera.source could not be read (${toErrorMessage(error)})`);
-            }
-            if (bytes.length > 64 * 1024 * 1024) {
-                throw new Error(`execution.desktop.media.camera.source is ${bytes.length} bytes; the camera feed is capped at 64 MiB`);
-            }
-            await desktop.commands.run(`mkdir -p ${SANDBOX_MEDIA_DIR}`, { requestTimeoutMs, timeoutMs: 15_000 });
-            const payload = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-            await desktop.files.write(SANDBOX_CAMERA_PATH, payload, { requestTimeoutMs, useOctetStream: true });
-            camera = { source: "file", file: SANDBOX_CAMERA_PATH };
-        }
-        flags.push("--use-fake-device-for-media-stream", `--use-file-for-fake-video-capture=${SANDBOX_CAMERA_PATH}`);
-    }
-    if (permission === "granted")
-        flags.push("--use-fake-ui-for-media-stream");
-    return { ...(camera === undefined ? {} : { camera }), permission, flags };
-}
 // Device/screen size comes from the named-preset registry (device-presets.ts), selectable per run
 // via execution.desktop.device (default `desktop`=1440x950). NOTE: this is run-wide for now; a
 // per-PERSONA device dimension (N personas × devices, as the bespoke sims author) lands with
@@ -172,19 +113,6 @@ const SUBJECT_PROVISION_BUDGET_MS = 30 * 60_000;
  *  The derived per-lane deadline has to stay under it, and saying so at plan time beats discovering
  *  it from a raw provider 400 after a plan has already printed. */
 const MAX_SANDBOX_MS = 60 * 60_000;
-export const SUBJECT_DIR = "/home/user/subject";
-// Remote path for the once-per-run packed local-tree archive; removed by the extract step
-// after it unpacks into SUBJECT_DIR.
-const LOCAL_TREE_REMOTE_ARCHIVE_PATH = "/home/user/.humanish-source.tar.gz";
-const CLONE_TIMEOUT_MS = 5 * 60_000;
-const INSTALL_TIMEOUT_MS = 10 * 60_000;
-const BUILD_TIMEOUT_MS = 10 * 60_000;
-const DEFAULT_READY_TIMEOUT_MS = 180_000;
-// Per-step budget for subject.state seed steps; each step's declared (or default) budget is
-// also summed into the default sandbox deadline so seeding never eats the session's room.
-const DEFAULT_STATE_STEP_TIMEOUT_MS = 5 * 60_000;
-// How much of a failing step's log tail rides the (redacted) error message.
-const ERROR_TAIL_CHARS = 2000;
 const DEFAULT_MISSION = "You are testing a web application. The browser is already open at the subject URL. Explore it, accomplish what the scenario asks, and stop when done.";
 /**
  * The participant's outcome as ONE fixed first line of its last message (#570, second half). The
@@ -262,21 +190,6 @@ export function withInboxMission(spec, inboxUrl, address, receiving = false) {
         instructions: `${spec.instructions}\n\nEmail inbox:${identity} When the app tells you it has emailed you (a verification link, confirmation code, or magic link), open ${recipientInboxUrl(inboxUrl, address)} in the browser to read that email and follow its link or enter its code. All email the app sends you arrives there. Waiting for an email is normal, not a blocker — do not end your session while waiting; open the inbox and refresh it until the email appears.`
     };
 }
-/** The lane's addressed comms recipient, when one exists — the gate AND the address source for the
- *  inbox instruction (#351). A lane told to check an inbox it can never receive into would stall,
- *  so no addressed recipient means no instruction. */
-export function inboxRecipientFor(commsEmail, laneId) {
-    return (commsEmail.recipients ?? []).find((recipient) => recipient.lane === laneId && recipient.address !== undefined);
-}
-/** True when a lane has a declared comms recipient WITH an address, so the drain can actually match the
- *  mail the persona will be told to read. Gates the inbox instruction to lanes that can receive mail —
- *  a lane told to check an inbox it can never receive into would just stall. */
-export function laneHasInboxRecipient(commsEmail, laneId) {
-    return inboxRecipientFor(commsEmail, laneId) !== undefined;
-}
-/** Mid-run inbox-surface render cadence (ms). Coarse enough that the per-tick `cat` + file writes stay
- *  cheap; fine enough that a verification email is visible seconds after the app sends it. */
-const INBOX_SURFACE_CADENCE_MS = 2500;
 /**
  * The narrowest browser WINDOW Chrome/Chromium will render on the E2B desktop. Chrome refuses to
  * make its window narrower than this (~500 CSS px observed: a 414-wide X screen produced a 500-wide
@@ -292,20 +205,6 @@ export const MIN_DESKTOP_RENDER_WIDTH = 500;
 export function floorRenderResolution(resolution) {
     return [Math.max(resolution[0], MIN_DESKTOP_RENDER_WIDTH), resolution[1]];
 }
-/**
- * The DECLARED preset to record alongside the rendered screen, or undefined when the preset
- * rendered faithfully.
- *
- * `desktopGeometry.screen.verified` compares the FLOORED number with itself, so on its own a
- * floored run is indistinguishable from a faithful one: a reader sees requested 500 / verified 500
- * and concludes a 500-wide screen was asked for. Recording the declared preset is what makes
- * "the preset width did not render" legible in the bundle.
- */
-export function declaredScreenForRender(preset, presetName, rendered) {
-    if (preset.width === rendered[0] && preset.height === rendered[1])
-        return undefined;
-    return { width: preset.width, height: preset.height, preset: presetName };
-}
 /**
  * Resolve a lane's device + rendered resolution (most-specific wins, exactly as the single-lane
  * path always has): a raw execution.desktop.resolution escape hatch (only legal when no lane
@@ -582,65 +481,6 @@ function formatLanePlanEntry(lane) {
     ].filter((part) => part !== undefined);
     return `${lane.id}: persona=${lane.persona}${taxonomy.length > 0 ? ` ${taxonomy.join(" ")}` : ""} device=${lane.device} ${lane.resolution[0]}x${lane.resolution[1]} prompt#${lane.instructionDigest}${lane.targetDigest ? ` target#${lane.targetDigest}` : ""}`;
 }
-/** ISO timestamp from an injectable clock (tests freeze `now` for deterministic durationMs). */
-function isoNow(now) {
-    return new Date(now()).toISOString();
-}
-/** Emit a phase-started event (no ok/durationMs: those belong to the matching completed event). */
-/**
- * Run a provisioning step and, when it fails with an EXIT CODE, run it once more (#602). A cold
- * install of 0.74.0 lost its whole first live study to one transient TLS error inside the
- * sandbox's `npm install`; the parallel install twenty seconds later passed, as had the ten
- * before it. One retry clears that class. A TIMEOUT is not retried: its budget is already spent,
- * and a second wait would double it. The retry runs under its own step name so both logs stay.
- */
-async function runProvisioningStepWithOneRetry(desktop, args) {
-    const first = await runDetachedStep(desktop, {
-        name: args.name,
-        command: args.command,
-        cwd: args.cwd,
-        timeoutMs: args.timeoutMs,
-        requestTimeoutMs: args.requestTimeoutMs,
-        ...args.timers
-    });
-    if (first.ok || first.timedOut)
-        return { ...first, attempts: 1 };
-    const retryStartedAt = args.now();
-    emitPhaseStarted(args.onPhase, args.now, args.retryPhase, `${args.retryMessage} (first attempt exited ${first.exitCode ?? "null"}; retrying once)`);
-    const second = await runDetachedStep(desktop, {
-        name: `${args.name}-retry`,
-        command: args.command,
-        cwd: args.cwd,
-        timeoutMs: args.timeoutMs,
-        requestTimeoutMs: args.requestTimeoutMs,
-        ...args.timers
-    });
-    emitPhaseCompleted(args.onPhase, args.now, retryStartedAt, args.retryPhase, second.ok, second.ok ? `${args.retryMessage}: succeeded on the second attempt` : `${args.retryMessage}: failed twice`);
-    return { ...second, attempts: 2, ...(first.exitCode === undefined ? {} : { firstExitCode: first.exitCode }) };
-}
-function emitPhaseStarted(onPhase, now, phase, message) {
-    onPhase?.({ at: isoNow(now), type: `cua-lab.subject.${phase}.started`, message });
-}
-/** Emit the matching phase-completed event: always carries ok and durationMs (>= 0). */
-function emitPhaseCompleted(onPhase, now, startedAt, phase, ok, message) {
-    onPhase?.({
-        at: isoNow(now),
-        type: `cua-lab.subject.${phase}.completed`,
-        ok,
-        durationMs: Math.max(0, now() - startedAt),
-        message
-    });
-}
-/** Default phase-boundary sink (stderr): one line per event, prefixed with the lane id ONLY
- *  when laneCount > 1. Single-lane emission is unconditional: total single-lane silence for the
- *  whole clone/install/build/ready boot is the bug this event stream exists to close.
- *  Overridable via CuaActorLabHooks.onPhase so deterministic tests capture instead of writing to
- *  the real stderr. */
-function defaultSubjectPhaseSink(event, ctx) {
-    const durationSuffix = event.durationMs === undefined ? "" : ` (${event.durationMs}ms)`;
-    const prefix = ctx.laneCount > 1 ? `humanish cua [${ctx.laneId}]` : "humanish cua";
-    process.stderr.write(`${prefix}: ${event.message}${durationSuffix}\n`);
-}
 /** Short id-safe suffix for a subject-phase RunEvent: drops the shared prefix/suffix so each
  *  phase gets a distinct bundle event id (e.g. "clone", "state-before-build"). */
 function phaseEventIdSuffix(type) {
@@ -681,36 +521,6 @@ export function makeLaneWriteScreenshot(artifactRoot, spec, screenshots) {
         return rel;
     };
 }
-/**
- * Verify the desktop screen geometry IN-SANDBOX (the per-lane device claim is checked, never
- * assumed). A parseable mismatch fails closed. Unavailable/unparseable evidence is returned as
- * an explicit warning: the lane may still run, but its bundle records only the requested screen
- * and never upgrades that request into a verified measurement.
- */
-export async function inspectDesktopScreenGeometry(args) {
-    let out = "";
-    try {
-        const result = await args.desktop.commands.run("xdpyinfo 2>/dev/null | grep -i dimensions || true", { requestTimeoutMs: args.requestTimeoutMs });
-        out = (result.stdout ?? "").trim();
-    }
-    catch {
-        return { warning: `Desktop screen geometry could not be measured for lane ${args.laneId}; requested geometry remains unverified.` };
-    }
-    const match = out.match(/(\d+)\s*x\s*(\d+)\s*pixels/i);
-    if (!match) {
-        return { warning: `Desktop screen geometry could not be parsed for lane ${args.laneId}; requested geometry remains unverified.` };
-    }
-    const width = Number(match[1]);
-    const height = Number(match[2]);
-    const [expectedWidth, expectedHeight] = args.requestedScreen;
-    if (width === expectedWidth && height === expectedHeight) {
-        return { verified: { width, height, source: "xdpyinfo" } };
-    }
-    return {
-        verified: { width, height, source: "xdpyinfo" },
-        error: `HUMANISH_CUA_LAB_DEVICE_GEOMETRY: lane ${args.laneId} requested a ${expectedWidth}x${expectedHeight} desktop but xdpyinfo reports ${width}x${height} in-sandbox; the per-lane device geometry is unverified (fail-closed).`
-    };
-}
 /** A blocked lane outcome (pipeline gate / fail-fast skipped it before it ran). */
 function blockedLaneOutcome(spec, reason) {
     return {
@@ -728,709 +538,6 @@ function blockedLaneOutcome(spec, reason) {
         harnessError: false
     };
 }
-async function findVisibleBrowserWindowId(desktop, requestTimeoutMs, browserFamily, launchIdentity) {
-    if (browserFamily === "unknown")
-        return undefined;
-    // The candidate loop keeps the LAST identity match: with a launch identity the match is
-    // unique anyway, and without one every family candidate matches, so the newest visible
-    // window of the launched family wins (the window this lane just opened).
-    const finder = browserFamily === "firefox"
-        ? [
-            "find_firefox_window() {",
-            "  timeout 2s xdotool search --onlyvisible --class 'firefox|Firefox' 2>/dev/null || true",
-            "}",
-            "window_id=",
-            "for _ in $(seq 1 10); do",
-            "  for candidate in $(find_firefox_window); do",
-            "    window_pid=\"$(xdotool getwindowpid \"$candidate\" 2>/dev/null || true)\"",
-            "    if matches_launch_identity \"$window_pid\"; then window_id=\"$candidate\"; fi",
-            "  done",
-            "  if [ -n \"$window_id\" ]; then break; fi",
-            "  sleep 0.5",
-            "done"
-        ]
-        : [
-            "find_chrome_window() {",
-            "  timeout 2s xdotool search --onlyvisible --class 'google-chrome|Google-chrome|chromium|Chromium|chrome|Chrome' 2>/dev/null || true",
-            "}",
-            "window_id=",
-            "for _ in $(seq 1 10); do",
-            "  for candidate in $(find_chrome_window); do",
-            "    window_pid=\"$(xdotool getwindowpid \"$candidate\" 2>/dev/null || true)\"",
-            "    if matches_launch_identity \"$window_pid\"; then window_id=\"$candidate\"; fi",
-            "  done",
-            "  if [ -n \"$window_id\" ]; then break; fi",
-            "  sleep 0.5",
-            "done"
-        ];
-    const result = await desktop.commands.run([
-        "set -euo pipefail",
-        "export DISPLAY=\"${DISPLAY:-:0}\"",
-        `launch_pid=${shellSingleQuote(launchIdentity?.processId ?? "")}`,
-        `profile_dir=${shellSingleQuote(launchIdentity?.profileDir ?? "")}`,
-        "matches_launch_identity() {",
-        "  if [ -z \"$launch_pid\" ] && [ -z \"$profile_dir\" ]; then return 0; fi",
-        "  local current=\"${1:-}\"",
-        "  while [[ \"$current\" =~ ^[0-9]+$ ]] && [ \"$current\" -gt 1 ]; do",
-        "    cmdline=\"$(tr '\\0' ' ' < \"/proc/$current/cmdline\" 2>/dev/null || true)\"",
-        "    if [ -n \"$profile_dir\" ] && [[ \"$cmdline\" == *\"$profile_dir\"* ]]; then return 0; fi",
-        "    if [ \"$current\" = \"$launch_pid\" ]; then return 0; fi",
-        "    current=\"$(ps -o ppid= -p \"$current\" 2>/dev/null | tr -d ' ' || true)\"",
-        "  done",
-        "  return 1",
-        "}",
-        ...finder,
-        "if [ -n \"$window_id\" ]; then printf 'WINDOW_ID=%s\\n' \"$window_id\"; fi"
-    ].join("\n"), {
-        requestTimeoutMs,
-        timeoutMs: 15_000
-    });
-    return (result.stdout ?? "").match(/^WINDOW_ID=(\S+)$/m)?.[1];
-}
-/**
- * Build the xdotool command that makes a browser window fill the desktop.
- * Exported (pure) for contract tests. A window manager can ignore Chrome's
- * --window-size, so xdotool is the robust path: move the window to the origin,
- * then size it to the exact desktop resolution so Observer screenshots carry no
- * dead margin around the browser.
- */
-export function buildFillDesktopWindowCommand(windowId, width, height) {
-    return [
-        "set -euo pipefail",
-        `win=${shellSingleQuote(windowId)}`,
-        `xdotool windowactivate "$win" >/dev/null 2>&1 || true`,
-        `xdotool windowmove "$win" 0 0 >/dev/null 2>&1 || true`,
-        `xdotool windowsize "$win" ${width} ${height} >/dev/null 2>&1 || true`,
-    ].join("\n");
-}
-/**
- * Best-effort initial fill. A contained smaller window remains usable; the capture
- * below checks for clipping and refuses an uncorrectable window before the actor runs.
- */
-async function fillDesktopBrowserWindow(desktop, windowId, resolution, requestTimeoutMs) {
-    const [width, height] = resolution;
-    await desktop.commands
-        .run(buildFillDesktopWindowCommand(windowId, width, height), {
-        requestTimeoutMs,
-        timeoutMs: 10_000,
-    })
-        .catch(() => undefined);
-}
-async function openDesktopBrowserTarget(desktop, targetUrl, requestTimeoutMs, browserPreference, 
-/** Launch-time flags that make mobile fidelity (#221) hold across every tab: the user agent and
- *  touch events are browser-wide here, where the CDP holder covers only the launch page. */
-extraChromiumFlags = []) {
-    const requestedBrowser = browserPreference ?? "default";
-    if (isHttpUrl(targetUrl)) {
-        const chromiumFlags = [...CHROMIUM_EVIDENCE_HYGIENE_FLAGS, ...extraChromiumFlags].map(shellSingleQuote).join(" ");
-        const browserLaunchCommand = [
-            "set -euo pipefail",
-            `target_url=${shellSingleQuote(targetUrl)}`,
-            `browser_preference=${shellSingleQuote(requestedBrowser)}`,
-            "chrome_profile_dir=",
-            `chrome_preferences_json=${shellSingleQuote(chromiumEvidenceProfilePreferencesJson())}`,
-            "prepare_chrome_profile() {",
-            "  chrome_profile_dir=\"$(mktemp -d /tmp/humanish-chrome-profile.XXXXXX)\"",
-            "  mkdir -p \"$chrome_profile_dir/Default\"",
-            "  printf '%s\\n' \"$chrome_preferences_json\" > \"$chrome_profile_dir/Default/Preferences\"",
-            "}",
-            "launch_browser() {",
-            "  local label=\"$1\"",
-            "  local binary=\"$2\"",
-            "  shift 2",
-            "  if command -v \"$binary\" >/dev/null 2>&1; then",
-            "    nohup \"$binary\" \"$@\" \"$target_url\" >/tmp/humanish-browser-open.log 2>&1 &",
-            "    local launch_pid=$!",
-            "    printf 'HUMANISH_BROWSER_RESOLVED=%s\\n' \"$label\"",
-            "    printf 'HUMANISH_BROWSER_PID=%s\\n' \"$launch_pid\"",
-            "    printf 'HUMANISH_BROWSER_PROFILE_DIR=%s\\n' \"$chrome_profile_dir\"",
-            "    if [[ \"$label\" =~ ^(google-chrome|google-chrome-stable|chromium|chromium-browser)$ ]]; then",
-            "      for _ in $(seq 1 30); do",
-            "        if [ -s \"$chrome_profile_dir/DevToolsActivePort\" ]; then",
-            "          head -n 1 \"$chrome_profile_dir/DevToolsActivePort\" | sed 's/^/HUMANISH_BROWSER_CDP_PORT=/'",
-            "          break",
-            "        fi",
-            "        sleep 0.1",
-            "      done",
-            "    fi",
-            "    return 0",
-            "  fi",
-            "  return 1",
-            "}",
-            // Fixed CDP port (not :0/random): each seat has its OWN desktop sandbox, so a known port
-            // cannot conflict, and it makes the observer's port resolution deterministic. With :0 the
-            // real port lives only in DevToolsActivePort; when the launch-time capture misses on a cold
-            // start the observer falls back to 9222 and — being wrong — every CDP read fails for the
-            // whole run (the lobby-code handoff then never sees the host's /lobby URL). 9222 is already
-            // the fallback, so making it the actual port aligns launch, capture, and fallback.
-            `chrome_debug_flags=(--remote-debugging-address=127.0.0.1 --remote-debugging-port=9222 ${chromiumFlags})`,
-            "open_target() {",
-            "  case \"$browser_preference\" in",
-            "    chrome)",
-            "      prepare_chrome_profile",
-            "      launch_browser google-chrome google-chrome --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser google-chrome-stable google-chrome-stable --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      echo 'requested browser chrome was not found' >&2",
-            "      return 127",
-            "      ;;",
-            "    chromium)",
-            "      prepare_chrome_profile",
-            "      launch_browser chromium chromium --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser chromium-browser chromium-browser --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      echo 'requested browser chromium was not found' >&2",
-            "      return 127",
-            "      ;;",
-            "    firefox)",
-            "      prepare_chrome_profile",
-            "      launch_browser firefox firefox --new-instance --no-remote --new-window --profile \"$chrome_profile_dir\" && return 0",
-            "      echo 'requested browser firefox was not found' >&2",
-            "      return 127",
-            "      ;;",
-            "    default)",
-            "      prepare_chrome_profile",
-            "      launch_browser google-chrome google-chrome --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser google-chrome-stable google-chrome-stable --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser chromium chromium --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser chromium-browser chromium-browser --new-window \"--user-data-dir=$chrome_profile_dir\" \"${chrome_debug_flags[@]}\" && return 0",
-            "      launch_browser firefox firefox --new-instance --no-remote --new-window --profile \"$chrome_profile_dir\" && return 0",
-            "      launch_browser xdg-open xdg-open && return 0",
-            "      echo 'no browser opener found' >&2",
-            "      return 127",
-            "      ;;",
-            "  esac",
-            "}",
-            "open_target"
-        ].join("\n");
-        const result = await runDesktopCommandOrThrow(() => desktop.commands.run(browserLaunchCommand, {
-            requestTimeoutMs,
-            timeoutMs: 15_000,
-        }), ({ exitCode, stderrTail }) => new Error(`browser launch failed${exitCode === undefined ? "" : ` with exit ${exitCode}`}: ${stderrTail}`));
-        if (result.exitCode !== undefined && result.exitCode !== 0) {
-            throw new Error(`browser launch failed with exit ${result.exitCode}: ${tailOf(result.stderr ?? result.stdout ?? "")}`);
-        }
-        const resolved = (result.stdout ?? "").match(/^HUMANISH_BROWSER_RESOLVED=(\S+)$/m)?.[1];
-        const processId = (result.stdout ?? "").match(/^HUMANISH_BROWSER_PID=(\d+)$/m)?.[1];
-        const profileDir = (result.stdout ?? "").match(/^HUMANISH_BROWSER_PROFILE_DIR=(\S+)$/m)?.[1];
-        const cdpPortRaw = (result.stdout ?? "").match(/^HUMANISH_BROWSER_CDP_PORT=(\d+)$/m)?.[1];
-        const cdpPort = cdpPortRaw === undefined ? undefined : Number(cdpPortRaw);
-        return {
-            family: desktopBrowserFamily(resolved ?? requestedBrowser),
-            ...(processId === undefined || profileDir === undefined
-                ? {}
-                : { identity: { processId, profileDir, targetUrl, ...(cdpPort === undefined ? {} : { cdpPort }) } }),
-            ...(browserPreference === undefined
-                ? {}
-                : { evidence: { requested: requestedBrowser, ...(resolved === undefined ? {} : { resolved }) } })
-        };
-    }
-    if (browserPreference === undefined || browserPreference === "default") {
-        if (desktop.open) {
-            await desktop.open(targetUrl);
-        }
-        else {
-            await desktop.launch("google-chrome", targetUrl);
-        }
-        return {
-            family: desktop.open ? "unknown" : "chromium",
-            ...(browserPreference === undefined ? {} : { evidence: { requested: requestedBrowser } })
-        };
-    }
-    const launchTarget = requestedBrowser === "chrome" ? "google-chrome"
-        : requestedBrowser === "chromium" ? "chromium"
-            : requestedBrowser === "firefox" ? "firefox"
-                : "google-chrome";
-    await desktop.launch(launchTarget, targetUrl);
-    return {
-        family: desktopBrowserFamily(launchTarget),
-        evidence: { requested: requestedBrowser, resolved: launchTarget }
-    };
-}
-export function desktopBrowserFamily(value) {
-    if (value === "firefox")
-        return "firefox";
-    if (value === "chrome" || value === "chromium" || value === "google-chrome" || value === "google-chrome-stable" || value === "chromium-browser") {
-        return "chromium";
-    }
-    return "unknown";
-}
-/**
- * The URL / title / page-text / scroll observer behind stopWhen and task criteria. One probe per
- * observation, run on the sandbox's python3 (see chrome-cdp-probe.ts for why not node: #514).
- *
- * "active": follow the participant to whatever tab they are driving now — never pin the state
- * observer to the launch tab (a verification link that opened in a NEW tab left a pinned observer
- * reading the old tab forever).
- *
- * `onUnavailable` fires ONCE, on the first probe that could not read the page, with the reason.
- * The observer still degrades to `{}` for the loop; the callback is how a lane says out loud that
- * url/text criteria are not being measured, instead of letting the funnel report 0/N (#514).
- */
-export function makeChromeBrowserStateObserver(desktop, requestTimeoutMs, endpoint, targetId, onUnavailable, 
-/**
- * Mobile emulation on later tabs (#623): the holder attaches to every page target Chrome opens
- * after the launch page, so a tab the participant opens later should lay out at the phone width
- * too. The first observation on each new target reads that page's OWN report; a target that
- * reports the requested width is recorded through `onCovered`, and one that does not (or cannot
- * be read) fires `onDrift` once, so a phone-labelled lane that spent part of its session at
- * desktop layout says so with the number the page gave.
- */
-drift) {
-    let reported = false;
-    let drifted = false;
-    const checkedTargets = new Set(drift === undefined ? [] : [drift.emulatedTargetId]);
-    const unavailable = (reason) => {
-        if (!reported) {
-            reported = true;
-            onUnavailable?.(reason);
-        }
-        return {};
-    };
-    const checkLaterTarget = async (newTargetId) => {
-        if (drift === undefined || checkedTargets.has(newTargetId))
-            return;
-        checkedTargets.add(newTargetId);
-        const read = await desktop.commands.run(chromeCdpProbeCommand({ ...endpoint, targetId: newTargetId, prefer: "pinned", mode: "fidelity" }), { requestTimeoutMs, timeoutMs: 5_000 });
-        const fidelity = read.exitCode !== undefined && read.exitCode !== 0 ? undefined : parseChromeCdpProbeOutput(read.stdout).fidelity;
-        if (fidelity !== undefined && fidelity.innerWidth === drift.expectedWidth) {
-            drift.onCovered?.(newTargetId, { innerWidth: fidelity.innerWidth, devicePixelRatio: fidelity.devicePixelRatio, maxTouchPoints: fidelity.maxTouchPoints });
-            if (drift.expectTouch === true && fidelity.maxTouchPoints === 0 && !drifted) {
-                // The viewport followed; touch did not (yet): the holder reloads a later tab once after its
-                // first navigation commits, and this observation may have landed before that reload.
-                drifted = true;
-                drift.onDrift(`a later page target reports the ${fidelity.innerWidth} px viewport but navigator.maxTouchPoints 0 on its first observation; touch reaches a document only when it loads under the override`);
-            }
-            return;
-        }
-        if (drifted)
-            return;
-        drifted = true;
-        drift.onDrift(fidelity === undefined
-            ? "the participant drove a page target other than the emulated launch tab and that page's own read-back could not be taken; whether it laid out at the phone width is not known"
-            : `the participant drove a page target other than the emulated launch tab and that page reports a ${fidelity.innerWidth} px viewport where ${drift.expectedWidth} px was requested (DPR ${fidelity.devicePixelRatio}); the mobile user agent and touch events are browser-wide, the viewport override was not re-applied to it`);
-    };
-    return async () => {
-        const result = await desktop.commands.run(chromeCdpProbeCommand({ ...endpoint, ...(targetId === undefined ? {} : { targetId }), prefer: "active", mode: "state" }), { requestTimeoutMs, timeoutMs: 5_000 });
-        if (result.exitCode !== undefined && result.exitCode !== 0) {
-            return unavailable(`probe exited ${result.exitCode}: ${tailOf(result.stderr ?? result.stdout ?? "")}`);
-        }
-        const parsed = parseChromeCdpProbeOutput(result.stdout);
-        if (parsed.unavailable !== undefined)
-            return unavailable(parsed.unavailable);
-        if (parsed.targetId !== undefined)
-            await checkLaterTarget(parsed.targetId);
-        return {
-            ...(parsed.url === undefined ? {} : { url: parsed.url }),
-            ...(parsed.title === undefined ? {} : { title: parsed.title }),
-            ...(parsed.text === undefined ? {} : { text: parsed.text }),
-            ...(parsed.scrollY === undefined ? {} : { scrollY: parsed.scrollY })
-        };
-    };
-}
-/**
- * Read the running browser's actual outer-window bounds and CSS layout viewport through the
- * already-enabled local Chrome DevTools endpoint. The returned values come from `window.*` in
- * the target page; requested E2B resolution is deliberately not an input to this function.
- * Missing channels report their reason via `onUnavailable`, so the geometry warning can name
- * the cause (a dead CDP endpoint, no python3) instead of only the symptom. Returns `undefined`
- * only when neither channel could be measured.
- * Outer bounds and CSS dimensions are independent channels: a background page can report zero
- * outer dimensions while still reporting a CSS viewport. Final captures follow the active tab;
- * launch captures and emulation attribution keep the pinned target.
- */
-export function makeChromeDesktopGeometryObserver(desktop, requestTimeoutMs, endpoint, targetId, onUnavailable, prefer = "pinned") {
-    return async () => {
-        const result = await desktop.commands.run(chromeCdpProbeCommand({ ...endpoint, ...(targetId === undefined ? {} : { targetId }), prefer, mode: "geometry" }), { requestTimeoutMs, timeoutMs: 5_000 });
-        if (result.exitCode !== undefined && result.exitCode !== 0) {
-            onUnavailable?.(`probe exited ${result.exitCode}: ${tailOf(result.stderr ?? result.stdout ?? "")}`);
-            return undefined;
-        }
-        const parsed = parseChromeCdpProbeOutput(result.stdout);
-        if (parsed.unavailable !== undefined) {
-            onUnavailable?.(parsed.unavailable);
-            return undefined;
-        }
-        const browserWindow = isMeasuredRect(parsed.browserWindow) ? { ...parsed.browserWindow, source: "cdp" } : undefined;
-        const viewport = isMeasuredViewport(parsed.viewport) ? { ...parsed.viewport, source: "cdp" } : undefined;
-        if (browserWindow === undefined && viewport === undefined) {
-            onUnavailable?.("the page reported no usable window or viewport dimensions");
-            return undefined;
-        }
-        if (browserWindow === undefined)
-            onUnavailable?.("the page reported no usable outer-window dimensions");
-        if (viewport === undefined)
-            onUnavailable?.("the page reported no usable CSS viewport dimensions");
-        return {
-            ...(browserWindow === undefined ? {} : { browserWindow }),
-            ...(viewport === undefined ? {} : { viewport }),
-            ...(parsed.targetId === undefined ? {} : { targetId: parsed.targetId })
-        };
-    };
-}
-/** The user agent a mobile-emulated lane presents unless the lab sets its own. */
-export const DEFAULT_MOBILE_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1";
-/**
- * Apply mobile emulation (#221) to the lane's launch page and read back what the page reports.
- * Fails CLOSED: a request that cannot be applied throws, because a desktop run labelled mobile is
- * the over-trust this feature exists to prevent. A read-back that cannot be taken is a warning
- * (the emulation was applied; only the proof is missing).
- */
-export async function applyMobileEmulation(desktop, requestTimeoutMs, endpoint, targetId, request) {
-    const command = (mode) => chromeCdpProbeCommand({ ...endpoint, ...(targetId === undefined ? {} : { targetId }), prefer: "pinned", mode, emulation: request });
-    const read = async () => {
-        const result = await desktop.commands.run(command("fidelity"), { requestTimeoutMs, timeoutMs: 15_000 });
-        if (result.exitCode !== undefined && result.exitCode !== 0) {
-            return { unavailable: `probe exited ${result.exitCode}: ${tailOf(result.stderr ?? result.stdout ?? "")}` };
-        }
-        return parseChromeCdpProbeOutput(result.stdout);
-    };
-    // The UA / touch / DPR overrides are bound to the DevTools session that set them and lapse the
-    // moment its socket closes (measured: only the viewport width survived a one-shot apply). So the
-    // applier stays attached for the lane's whole life as a detached process; the sandbox teardown
-    // ends it. Its first stdout line says what was applied.
-    const holderName = `mobile-emulation-${Date.now().toString(36)}`;
-    await startDetachedProcess(desktop, { name: holderName, command: command("hold"), requestTimeoutMs });
-    let announced;
-    for (let attempt = 0; attempt < 30 && announced === undefined; attempt += 1) {
-        await new Promise((resolve) => setTimeout(resolve, 500));
-        const log = await readDetachedLog(desktop, holderName, requestTimeoutMs).catch(() => "");
-        const line = log.split("\n").find((candidate) => candidate.trim().startsWith("{"));
-        if (line !== undefined)
-            announced = parseChromeCdpProbeOutput(line);
-    }
-    if (announced === undefined) {
-        throw new Error("mobile emulation could not be applied: the in-sandbox applier printed nothing within 15 s");
-    }
-    if (announced.unavailable !== undefined) {
-        throw new Error(`mobile emulation could not be applied (${announced.unavailable}); applied before failing: ${(announced.applied ?? []).join(", ") || "nothing"}`);
-    }
-    const applied = announced;
-    // Viewport/touch read-back proves context settings, not gesture equivalence. Two hosted
-    // replicas and a native-X conversion-toggle control reproduced reset click counts (#676).
-    const warnings = request.touch
-        ? ["Mobile emulation uses desktop pointer-to-touch conversion, which can differ for repeated taps. Confirm gesture failures with direct or native touch input before attributing them to the app."]
-        : [];
-    // The reload inside the applier takes a moment; the read-back is retried until the page reports
-    // the requested viewport and user agent, so a slow page does not read as "no proof".
-    let readBack = await read();
-    for (let attempt = 0; attempt < 20 && (readBack.fidelity === undefined || readBack.fidelity.innerWidth !== request.width || !readBack.fidelity.userAgent.includes(request.userAgent.slice(0, 24))); attempt += 1) {
-        await new Promise((resolve) => setTimeout(resolve, 500));
-        readBack = await read();
-    }
-    const fidelityRead = readBack;
-    const requested = {
-        width: request.width,
-        height: request.height,
-        deviceScaleFactor: request.deviceScaleFactor,
-        touch: request.touch,
-        userAgent: request.userAgent
-    };
-    const emulatedTargetId = applied.targetId ?? fidelityRead.targetId;
-    if (fidelityRead.fidelity === undefined) {
-        warnings.push(`Mobile emulation was applied but the page's own report could not be read (${fidelityRead.unavailable ?? "no fidelity read"}); desktopGeometry.fidelity carries the request without a resolved block.`);
-        return { fidelity: { tier: "mobile-emulated", requested, applied: applied.applied ?? [] }, warnings, holderName, ...(emulatedTargetId === undefined ? {} : { targetId: emulatedTargetId }) };
-    }
-    const resolved = { ...fidelityRead.fidelity, source: "cdp" };
-    if (resolved.innerWidth !== request.width) {
-        warnings.push(`Mobile emulation requested a ${request.width} px viewport; the page reports ${resolved.innerWidth} px.`);
-    }
-    if (resolved.devicePixelRatio !== request.deviceScaleFactor) {
-        warnings.push(`Mobile emulation requested devicePixelRatio ${request.deviceScaleFactor}; the page reports ${resolved.devicePixelRatio}.`);
-    }
-    if (request.touch && resolved.maxTouchPoints === 0) {
-        warnings.push("Mobile emulation requested touch; the page reports navigator.maxTouchPoints 0.");
-    }
-    if (!resolved.userAgent.includes("Mobile") && !resolved.userAgent.includes("Android") && !resolved.userAgent.includes("iPhone")) {
-        warnings.push("Mobile emulation requested a mobile user agent; the page reports a desktop one.");
-    }
-    return { fidelity: { tier: "mobile-emulated", requested, applied: applied.applied ?? [], resolved }, warnings, holderName, ...(emulatedTargetId === undefined ? {} : { targetId: emulatedTargetId }) };
-}
-function isMeasuredRect(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const record = value;
-    return Number.isFinite(record.x)
-        && Number.isFinite(record.y)
-        && isPositiveMeasurement(record.width)
-        && isPositiveMeasurement(record.height);
-}
-function isMeasuredViewport(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const record = value;
-    return isPositiveMeasurement(record.width)
-        && isPositiveMeasurement(record.height)
-        && isPositiveMeasurement(record.deviceScaleFactor);
-}
-function isPositiveMeasurement(value) {
-    return typeof value === "number" && Number.isFinite(value) && value > 0;
-}
-async function measureBrowserWindowWithXdotool(desktop, windowId, requestTimeoutMs) {
-    const result = await desktop.commands.run([
-        "set -euo pipefail",
-        `win=${shellSingleQuote(windowId)}`,
-        "xdotool getwindowgeometry --shell \"$win\" 2>/dev/null || true"
-    ].join("\n"), { requestTimeoutMs, timeoutMs: 5_000 });
-    const output = result.stdout ?? "";
-    const read = (name) => {
-        const raw = output.match(new RegExp(`^${name}=(-?\\d+)$`, "m"))?.[1];
-        if (raw === undefined)
-            return undefined;
-        const value = Number(raw);
-        return Number.isFinite(value) ? value : undefined;
-    };
-    const x = read("X");
-    const y = read("Y");
-    const width = read("WIDTH");
-    const height = read("HEIGHT");
-    if (x === undefined || y === undefined || width === undefined || height === undefined || width <= 0 || height <= 0) {
-        return undefined;
-    }
-    return { x, y, width, height, source: "xdotool" };
-}
-/** Physical X client bounds, never the page's emulated window.outerWidth/Height. */
-function isBrowserWindowContained(bounds, [width, height]) {
-    return bounds.x >= 0 && bounds.y >= 0
-        && bounds.x + bounds.width <= width && bounds.y + bounds.height <= height;
-}
-/** One bounded repair. Window-manager decorations may keep the client origin below (0, 0),
- * so a full-screen client height can clip the bottom even after windowmove succeeds. */
-async function fitBrowserWindowWithinDesktop(desktop, windowId, resolution, requestTimeoutMs) {
-    const run = (command) => desktop.commands.run([
-        "set -euo pipefail",
-        `win=${shellSingleQuote(windowId)}`,
-        command
-    ].join("\n"), { requestTimeoutMs, timeoutMs: 5_000 }).catch(() => undefined);
-    await run('xdotool windowmove "$win" 0 0');
-    await desktop.wait(250).catch(() => undefined);
-    const moved = await measureBrowserWindowWithXdotool(desktop, windowId, requestTimeoutMs).catch(() => undefined);
-    if (moved === undefined)
-        return moved;
-    let resized = moved;
-    const width = resolution[0] - moved.x;
-    const height = resolution[1] - moved.y;
-    // Resizing alone cannot fix an offscreen client origin. The window manager
-    // can also center a minimum-width client at a negative x on a narrow screen.
-    if (moved.x >= 0 && moved.y >= 0 && width > 0 && height > 0) {
-        await run(`xdotool windowsize "$win" ${width} ${height}`);
-        await desktop.wait(250).catch(() => undefined);
-        const measured = await measureBrowserWindowWithXdotool(desktop, windowId, requestTimeoutMs).catch(() => undefined);
-        if (measured === undefined)
-            return measured;
-        resized = measured;
-    }
-    if (resized === undefined || isBrowserWindowContained(resized, resolution))
-        return resized;
-    // Chrome's minimum client width can equal the whole desktop. Window-manager
-    // borders then make a decorated window impossible to contain, even after a
-    // successful move/resize. Request fullscreen once and prove the physical result.
-    // xprop/xdotool ship with the desktop template; wmctrl is not required.
-    // Check state first so the fullscreen shortcut cannot toggle an existing state off.
-    await run([
-        'state=$(xprop -id "$win" _NET_WM_STATE)',
-        'case "$state" in',
-        '  *_NET_WM_STATE_FULLSCREEN*) ;;',
-        '  *) xdotool windowactivate --sync "$win"; xdotool key --clearmodifiers F11 ;;',
-        'esac'
-    ].join("\n"));
-    // The fullscreen animation may report its new origin before its final width.
-    // Give the window manager a bounded settling window, keeping missing reads unverified.
-    for (let attempt = 0; attempt < 4; attempt += 1) {
-        await desktop.wait(250).catch(() => undefined);
-        const measured = await measureBrowserWindowWithXdotool(desktop, windowId, requestTimeoutMs).catch(() => undefined);
-        if (measured === undefined || isBrowserWindowContained(measured, resolution))
-            return measured;
-        resized = measured;
-    }
-    return resized;
-}
-/** Shared hosted-browser geometry capture used by per-lane and sequential shared-world routes. */
-export async function captureDesktopBrowserGeometry(args) {
-    const warnings = [];
-    let browserWindowId = args.browserWindowId;
-    if (browserWindowId === undefined && args.browserFamily !== "unknown") {
-        browserWindowId = await findVisibleBrowserWindowId(args.desktop, args.requestTimeoutMs, args.browserFamily, args.launchIdentity).catch((error) => {
-            warnings.push(`Browser window lookup failed for lane ${args.laneId}: ${redactText(toErrorMessage(error))}`);
-            return undefined;
-        });
-    }
-    let xdotoolWindow;
-    if (browserWindowId !== undefined) {
-        if (args.resize !== false) {
-            await fillDesktopBrowserWindow(args.desktop, browserWindowId, args.requestedScreen, args.requestTimeoutMs);
-            // Let the window manager apply the resize before querying both X and page layout geometry.
-            await args.desktop.wait(250).catch(() => undefined);
-        }
-        xdotoolWindow = await measureBrowserWindowWithXdotool(args.desktop, browserWindowId, args.requestTimeoutMs)
-            .catch(() => undefined);
-    }
-    else {
-        warnings.push(`Browser window bounds could not be measured for lane ${args.laneId}; the live stream will use the full desktop.`);
-    }
-    let unusable;
-    if (xdotoolWindow !== undefined && !isBrowserWindowContained(xdotoolWindow, args.requestedScreen)) {
-        const before = xdotoolWindow;
-        if (args.resize !== false && browserWindowId !== undefined) {
-            xdotoolWindow = await fitBrowserWindowWithinDesktop(args.desktop, browserWindowId, args.requestedScreen, args.requestTimeoutMs);
-            if (xdotoolWindow === undefined) {
-                // Keep the last measured bad state; a missing observation cannot prove a successful fix.
-                xdotoolWindow = before;
-                unusable = `Physical browser containment could not be verified after correction for lane ${args.laneId}; the last measured window was clipped.`;
-            }
-            else if (isBrowserWindowContained(xdotoolWindow, args.requestedScreen)) {
-                warnings.push(`Browser window clipping corrected for lane ${args.laneId}; physical bounds are ${xdotoolWindow.width}x${xdotoolWindow.height} at (${xdotoolWindow.x}, ${xdotoolWindow.y}).`);
-            }
-        }
-        if (unusable === undefined && !isBrowserWindowContained(xdotoolWindow, args.requestedScreen)) {
-            unusable = `Browser window is outside the captured ${args.requestedScreen[0]}x${args.requestedScreen[1]} desktop for lane ${args.laneId}: physical bounds ${xdotoolWindow.width}x${xdotoolWindow.height} at (${xdotoolWindow.x}, ${xdotoolWindow.y}), right=${xdotoolWindow.x + xdotoolWindow.width}, bottom=${xdotoolWindow.y + xdotoolWindow.height}.`;
-        }
-        if (unusable !== undefined)
-            warnings.push(unusable);
-    }
-    if (xdotoolWindow === undefined) {
-        warnings.push(`Physical browser containment is unverified for lane ${args.laneId}; X window bounds could not be measured. Page-reported outer dimensions can be emulated and do not prove physical visibility.`);
-    }
-    let cdpUnavailable;
-    const chromeGeometry = args.browserFamily === "chromium"
-        ? await makeChromeDesktopGeometryObserver(args.desktop, args.requestTimeoutMs, {
-            ...(args.launchIdentity?.cdpPort === undefined ? {} : { cdpPort: args.launchIdentity.cdpPort }),
-            ...(args.launchIdentity?.profileDir === undefined ? {} : { profileDir: args.launchIdentity.profileDir }),
-            targetUrl: args.targetUrl
-        }, args.browserTargetId, (reason) => {
-            cdpUnavailable = reason;
-        }, args.pagePreference ?? "pinned")().catch((error) => {
-            cdpUnavailable = toErrorMessage(error);
-            return undefined;
-        })
-        : undefined;
-    const browserWindow = xdotoolWindow ?? chromeGeometry?.browserWindow;
-    const viewport = chromeGeometry?.viewport;
-    // The fill check reads the X window when it was measured: under mobile emulation (#221) the
-    // page's window.outerWidth reports the EMULATED screen (414), which is not a fill failure.
-    const fillBounds = xdotoolWindow;
-    if (!browserWindow) {
-        warnings.push(`Browser outer bounds could not be measured for lane ${args.laneId}.`);
-    }
-    else if (unusable === undefined && fillBounds !== undefined && (fillBounds.x !== 0 || fillBounds.y !== 0 || fillBounds.width !== args.requestedScreen[0] || fillBounds.height !== args.requestedScreen[1])) {
-        warnings.push(`Browser window fill did not reach the requested ${args.requestedScreen[0]}x${args.requestedScreen[1]} screen for lane ${args.laneId}; measured physical bounds are ${fillBounds.width}x${fillBounds.height} at (${fillBounds.x}, ${fillBounds.y}).`);
-    }
-    if (!viewport) {
-        // Name the cause, not only the symptom: the same dead DevTools channel that loses the viewport
-        // loses every url/text observation, and a reader of the bundle should learn that here (#514).
-        const cause = cdpUnavailable === undefined ? "" : ` DevTools probe: ${redactText(cdpUnavailable)}.`;
-        warnings.push(args.browserFamily === "firefox"
-            ? `Browser CSS viewport measurement is unavailable for Firefox on lane ${args.laneId}; stream.viewport is omitted instead of reading a different browser's CDP endpoint.`
-            : `Browser CSS viewport could not be measured for lane ${args.laneId}; stream.viewport is omitted instead of copying the requested screen resolution.${cause}`);
-    }
-    return {
-        ...(unusable === undefined ? {} : { unusable }),
-        ...(browserWindowId === undefined ? {} : { browserWindowId }),
-        ...(chromeGeometry?.targetId === undefined ? {} : { browserTargetId: chromeGeometry.targetId }),
-        ...(browserWindow === undefined ? {} : { browserWindow }),
-        ...(viewport === undefined ? {} : { viewport }),
-        warnings
-    };
-}
-function shellSingleQuote(value) {
-    return `'${value.replace(/'/g, "'\\''")}'`;
-}
-/**
- * Prepare a CLI study's runtime and, only when declared, its product (#495, #515).
- *
- * The install runs UNKEYED and before the session starts, for the same reason the clone route
- * provisions its subject first: what is being studied begins when the participant looks at the
- * screen. Omitting install deliberately studies product installation; Node/npm remain a
- * harness prerequisite so the participant can follow the product's public npm instructions.
- */
-async function provisionDesktopCli(desktop, args) {
-    const install = args.install;
-    const now = () => Date.now();
-    if (install === undefined || needsNodeRuntime([install])) {
-        const startedAt = now();
-        emitPhaseStarted(args.onPhase, now, "runtime", "providing Node/npm for the desktop CLI study");
-        const bootstrap = await runDetachedStep(desktop, {
-            name: "desktop-cli-runtime-node",
-            command: TERMINAL_NODE_BOOTSTRAP_COMMAND,
-            cwd: "/home/user",
-            timeoutMs: INSTALL_TIMEOUT_MS,
-            requestTimeoutMs: args.requestTimeoutMs
-        });
-        emitPhaseCompleted(args.onPhase, now, startedAt, "runtime", bootstrap.ok, bootstrap.ok
-            ? "Node runtime ready"
-            : "Node runtime bootstrap failed");
-        if (!bootstrap.ok) {
-            throw new Error(`desktop-cli runtime bootstrap failed for "${args.product}"`);
-        }
-    }
-    if (install === undefined)
-        return;
-    const startedAt = now();
-    emitPhaseStarted(args.onPhase, now, "install", `installing ${args.product} on the desktop`);
-    const result = await runDetachedStep(desktop, {
-        name: "desktop-cli-install",
-        command: install,
-        cwd: "/home/user",
-        timeoutMs: INSTALL_TIMEOUT_MS,
-        requestTimeoutMs: args.requestTimeoutMs
-    });
-    emitPhaseCompleted(args.onPhase, now, startedAt, "install", result.ok, result.ok
-        ? `${args.product} installed`
-        : `installing ${args.product} failed`);
-    if (!result.ok) {
-        // Fail closed: a participant handed a desktop where the product is not installed would produce
-        // a transcript about a missing command, and that finding belongs to the harness, not the tool.
-        // The tail rides along, scrubbed before truncation like every other provisioning failure — a
-        // bare "install failed" is unactionable to whoever wrote the command.
-        throw new Error(args.scrub(`desktop-cli install failed for "${args.product}" (${result.timedOut ? "timed out" : `exit ${result.exitCode ?? "?"}`}): ${tailOf(args.scrub(result.logTail))}`));
-    }
-}
-/**
- * Open a terminal window on the desktop.
- *
- * The stock template is XFCE and ships xfce4-terminal (also aliased x-terminal-emulator), verified
- * live before this route was built. `x-terminal-emulator` is tried first so a template that swaps
- * the emulator still works; a desktop with neither is a template problem and fails closed rather
- * than handing a participant an empty screen and calling it a study.
- */
-async function openDesktopTerminal(desktop, requestTimeoutMs, workdir) {
-    const dir = workdir ?? "/home/user";
-    const result = await runDetachedStep(desktop, {
-        name: "desktop-cli-terminal",
-        command: [
-            "for candidate in x-terminal-emulator xfce4-terminal gnome-terminal konsole xterm; do",
-            '  if command -v "$candidate" >/dev/null 2>&1; then',
-            // LANG is set on the terminal we open, not globally: the stock image declares no locale, and
-            // a study that measures our own mojibake against an unconfigured template would be measuring
-            // the template. The PRODUCT-side fix (an ASCII fallback when the locale is not UTF-8) is in
-            // src/terminal-encoding.ts, and it is the one that matters for real users.
-            `    (cd ${shellSingleQuote(dir)} 2>/dev/null || cd /home/user; DISPLAY=:0 LANG=C.UTF-8 LC_ALL=C.UTF-8 HUMANISH_STUDY_PARTICIPANT=1 nohup "$candidate" >/dev/null 2>&1 &)`,
-            "    sleep 3",
-            '    echo "humanish: opened $candidate"',
-            "    exit 0",
-            "  fi",
-            "done",
-            "echo 'humanish: no terminal emulator on this desktop template' >&2",
-            "exit 1"
-        ].join("\n"),
-        cwd: "/home/user",
-        timeoutMs: 60_000,
-        requestTimeoutMs
-    });
-    if (!result.ok) {
-        throw new Error("desktop-cli lane could not open a terminal on this desktop template");
-    }
-}
-async function startDesktopStream(desktop, browserWindowId) {
-    if (!browserWindowId) {
-        await desktop.stream.start({ requireAuth: true });
-        return;
-    }
-    try {
-        await desktop.stream.start({ requireAuth: true, windowId: browserWindowId });
-    }
-    catch {
-        await desktop.stream.start({ requireAuth: true });
-    }
-}
 // "can't" followed by a PERCEPTION verb describes what the screen showed, not an inability to
 // proceed: "the canvas truncates it so you can't even read the whole thing", "I can't tell from
 // the screen whether the rename is persisted", "so I could not read its full description". Five
@@ -1640,118 +747,18 @@ export function resolveSelfReportedFriction(session) {
         return reports.join("\n\n");
     return undefined;
 }
-/**
- * Run ONE E2B desktop lane end-to-end: create the sandbox (per-lane metadata + the lane's device
- * resolution), prepareDesktop, verify geometry, (clone+serve+seed the subject per lane), open the
- * browser, run the session, and ALWAYS tear down THIS lane's sandbox BY ID in a finally. Never
- * enumerates sandboxes. Extracted from the former single-lane block; at N=1 it writes the exact
- * same artifacts (actor.json, screenshots/<name>) the bundle has always referenced.
- */
+/** Run one participant against a prepared desktop. The adapter owns provisioning, final
+ * evidence and cleanup; this runner owns the model, trace and participant outcome. */
 export async function runCuaLane(spec, deps) {
-    const { config, appUrl, cloneRoute, localTreeRoute, serve, subjectRepo, subjectEnvNames } = deps;
-    const desktopCliRoute = deps.desktopCliRoute === true;
-    // The local brain, when there is one. `appServer` / `claudeSession` own a process, so the lane
-    // closes it.
+    const { config, env } = deps;
     let appServer;
     let claudeSession;
     let localAgentProvider;
-    const subjectEnvValues = config.subject.envValues ?? {};
-    const targetUrl = spec.targetUrl ?? appUrl;
-    const env = deps.env;
-    // Off-app comms (#297): on an in-sandbox subject route, redirect the app's email-API sends into an
-    // in-sandbox catch (loopback) so its verification mail is CAPTURED, not sent to the internet. Gated
-    // ENTIRELY on config.comms — no comms declared → zero change. The base-URL env is injected at
-    // sandbox-create (below, so the app reads it at boot); the catch is started right after create.
-    const commsEmail = (cloneRoute || localTreeRoute) && config.comms?.email?.kind === "fake" ? config.comms.email : undefined;
-    const commsPort = commsEmail ? (commsEmail.port ?? DEFAULT_SANDBOX_CATCH_PORT) : undefined;
-    // Hoisted so the finally can drain the catch before teardown; `commsArtifactPath` is the written
-    // evidence path folded into the lane outcome.
-    let deployedComms;
-    let commsArtifactPath;
-    let receivingInboxUrl;
-    // injectEnv is absent on an adopter-hosted plane (#328): there is no subject env to inject
-    // because the operator points their own app at their own catch.
-    const commsEnv = commsEmail?.injectEnv !== undefined && commsPort !== undefined
-        ? { [commsEmail.injectEnv]: `http://127.0.0.1:${commsPort}` }
-        : {};
-    // SMTP transport: the same idea as injectEnv, but an app that speaks SMTP needs a host and a port
-    // rather than a base URL. The catch accepts any credentials (loopback only), yet many apps refuse
-    // to boot unless the user/password vars exist at all, so those are injected when declared.
-    const commsSmtpPort = commsEmail?.smtp?.port;
-    if (commsEmail?.smtp && commsSmtpPort !== undefined) {
-        commsEnv[commsEmail.smtp.hostEnv] = "127.0.0.1";
-        commsEnv[commsEmail.smtp.portEnv] = String(commsSmtpPort);
-        if (commsEmail.smtp.userEnv)
-            commsEnv[commsEmail.smtp.userEnv] = commsEmail.smtp.user ?? "humanish";
-        if (commsEmail.smtp.passwordEnv)
-            commsEnv[commsEmail.smtp.passwordEnv] = commsEmail.smtp.password ?? "humanish";
-    }
-    // Persona inbox SURFACE (#297 slice B): the loopback URL the persona opens to read captured mail; the
-    // origin-rewrite map (identity on this same-sandbox route, but covers localhost/0.0.0.0 alias skew + an
-    // operator-declared linkOrigin); and a disposable background loop that renders the surface DURING the
-    // session so the inbox is live when the persona checks. The surface uses its OWN FakeInbox + cursor,
-    // independent of the teardown evidence drain (two readers of the append-only NDJSON — no double-count).
-    const commsInboxUrl = commsEmail && commsPort !== undefined ? `http://127.0.0.1:${commsPort}/inbox` : undefined;
-    const commsOriginMap = commsEmail
-        ? buildOriginMap({
-            ...(config.subject.serve?.url === undefined ? {} : { internalServeUrl: config.subject.serve.url }),
-            reachableBaseUrl: targetUrl,
-            ...(commsEmail.linkOrigin === undefined ? {} : { linkOrigin: commsEmail.linkOrigin })
-        })
-        : [];
-    const surfaceRecipients = (commsEmail?.recipients ?? [])
-        .filter((recipient) => recipient.address !== undefined)
-        .map((recipient) => ({ lane: recipient.lane, address: recipient.address }));
-    let surfaceRenderedCount = 0;
-    let surfaceDisposed = false;
-    let releaseSurface = () => { };
-    const surfaceDispose = new Promise((resolve) => { releaseSurface = resolve; });
-    let surfaceLoop;
     const warnings = [];
     const screenshots = [];
     const writeScreenshot = makeLaneWriteScreenshot(deps.artifactRoot, spec, screenshots);
-    const stateStepRecords = [];
-    // Completed-only trail (durationMs/ok are set on completed events, never on started ones):
-    // this is what survives into bundle.events. The default/injected sink below sees EVERY event,
-    // started and completed alike, so an operator watching stderr sees both halves of each phase.
-    const phaseRecords = [];
-    const onSubjectPhase = (event) => {
-        if (event.ok !== undefined) {
-            phaseRecords.push(event);
-        }
-        (deps.hooks.onPhase ?? defaultSubjectPhaseSink)(event, { laneId: spec.laneId, laneCount: deps.laneCount });
-    };
     let session;
     let sessionError;
-    let failureCode;
-    let sandboxId;
-    // Host-side E2B desktop billed-span endpoints, measured via the injected clock. Captured right
-    // after create() succeeds and again in the finally after teardown resolves (both the killed and
-    // kept-for-debug paths). This measured span excludes allocation before the acquired handle;
-    // a kept/unconfirmed allocation gets an extra unknown lifetime cost line.
-    let sandboxCreatedAtMs;
-    let sandboxTornDownAtMs;
-    let desktopResources;
-    let killed = false;
-    let streamUrl;
-    let subjectCommit;
-    let desktopBrowser;
-    let launchedBrowserFamily = "unknown";
-    let browserLaunchIdentity;
-    let browserLaunched = false;
-    let initialBrowserGeometry;
-    let appliedFidelity;
-    let emulatedTargetId;
-    let emulationHolderName;
-    let browserWindowId;
-    let browserTargetId;
-    const declaredScreen = declaredScreenForRender(spec.devicePreset, spec.deviceName, spec.resolution);
-    let desktopGeometry = {
-        screen: {
-            requested: { width: spec.resolution[0], height: spec.resolution[1] },
-            ...(declaredScreen ? { declared: declaredScreen } : {})
-        }
-    };
     let provisioned = false;
     let signaled = false;
     const signal = (ok) => {
@@ -1760,635 +767,137 @@ export async function runCuaLane(spec, deps) {
             deps.signalProvisioned(ok);
         }
     };
-    let desktopModule;
-    let desktop;
+    const desktopLane = deps.createDesktopLane?.(spec, warnings) ?? createE2BCuaDesktopLane(spec, deps, warnings);
     try {
-        desktopModule = await (deps.hooks.loadDesktopModule ?? loadE2BDesktopModule)();
-        // Optional custom desktop template (image): present → Sandbox.create(template, opts); absent →
-        // the byte-stable Sandbox.create(opts) default (stock `desktop` template).
-        desktop = await createDesktopSandbox(desktopModule, {
-            apiKey: deps.e2bApiKey,
-            requestTimeoutMs: deps.requestTimeoutMs,
-            timeoutMs: deps.perLaneSandboxMs,
-            metadata: {
-                ...CUA_ACTOR_LAB_PROVIDER_METADATA,
-                labId: config.id,
-                simId: spec.simId,
-                laneId: spec.laneId,
-                laneIndex: String(spec.laneIndex),
-                laneCount: String(deps.laneCount)
-            },
-            // Env placement per the doctrine: the ACTOR's key never enters the sandbox (the model drives
-            // from outside). The SUBJECT's declared env NAMES are provisioned here on the clone route.
-            // Three sources, in precedence order: committed non-secret config (subject.envValues), then
-            // secret values forwarded from the caller's environment (subject.env), then the harness's own
-            // comms wiring, which must win because only it knows the catch's address.
-            ...(subjectEnvNames.length > 0 || Object.keys(subjectEnvValues).length > 0 || Object.keys(commsEnv).length > 0
-                ? {
-                    envs: {
-                        ...subjectEnvValues,
-                        ...Object.fromEntries(subjectEnvNames.map((name) => [name, env[name]])),
-                        ...commsEnv
-                    }
-                }
-                : {}),
-            resolution: spec.resolution,
-            dpi: 96,
-            lifecycle: { onTimeout: "kill" }
-        }, config.execution?.desktop?.template, {
-            // The default loader reclaims an acquired handle before retrying failed desktop startup.
-            // Its error names the cleanup outcome; pre-construction allocation failures remain unowned.
-            onRetry: (reason) => {
-                const named = redactText(deps.scrubKnownValues(reason));
-                warnings.push(`Sandbox create for lane ${spec.laneId} retried once after a transient provider error (${named}).`);
-                onSubjectPhase({ at: new Date(deps.now()).toISOString(), type: "cua-lab.sandbox.create.retry", message: `sandbox create retried once (${named})` });
-            }
-        });
-        sandboxId = desktop.sandboxId;
-        // #358 salvage: journal the id to disk before any work — an interrupted run reclaims by
-        // exact recorded id (`humanish reclaim`), never by enumerating the account.
-        await appendSandboxReceipt(deps.artifactRoot, { at: new Date(deps.now()).toISOString(), laneId: spec.laneId, sandboxId, timeoutMs: deps.perLaneSandboxMs });
-        // The billed span starts the instant the sandbox exists.
-        sandboxCreatedAtMs = deps.now();
-        desktopResources = await observeDesktopResources(desktop);
-        if ("reason" in desktopResources) {
-            warnings.push(`Desktop resource size unavailable (${desktopResources.reason}); compute cost remains unpriced.`);
-        }
-        if (deps.hooks.prepareDesktop) {
-            await deps.hooks.prepareDesktop(desktop, { laneId: spec.laneId, laneIndex: spec.laneIndex, laneCount: deps.laneCount });
-        }
-        // Start the in-sandbox email catch BEFORE the subject serve, so the app's send-API base URL (injected
-        // into its env at create) resolves the moment it boots. A comms-declared lab that can't stand the
-        // catch up is a setup failure (fail closed) rather than silently sending real mail.
-        if (deps.receiving) {
-            const surface = await deployReceivingInbox(desktop, { leaseId: spec.streamId, requestTimeoutMs: Math.min(deps.requestTimeoutMs, 30_000) });
-            receivingInboxUrl = surface.url;
-            const email = config.comms?.email;
-            try {
-                await deps.receiving.attach(spec.laneId, {
-                    surface,
-                    allowedOrigins: [...new Set([new URL(targetUrl).origin, ...(email?.allowedOrigins ?? [])])],
-                    originMap: buildOriginMap({
-                        ...(config.subject.serve?.url === undefined ? {} : { internalServeUrl: config.subject.serve.url }),
-                        reachableBaseUrl: targetUrl,
-                        ...(email?.linkOrigin === undefined ? {} : { linkOrigin: email.linkOrigin })
-                    })
-                });
-                commsArtifactPath = "comms/receiving.json";
-            }
-            catch (error) {
-                await surface.stop().catch(() => { });
-                throw error;
-            }
-        }
-        if (commsEmail && commsPort !== undefined) {
-            deployedComms = await deployCommsCatch(desktop, {
-                port: commsPort,
-                ...(commsSmtpPort === undefined ? {} : { smtpPort: commsSmtpPort }),
-                requestTimeoutMs: deps.requestTimeoutMs
+        await desktopLane.prepare();
+        // Start the brain BEFORE the first screenshot: the app-server handshake is ~500ms, and it
+        // is paid here, while the sandbox is still settling, rather than inside turn one.
+        if (deps.localAgent === "codex") {
+            appServer = await startAppServerSession({
+                ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
+                ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model }),
+                // The persona lives on the THREAD, so it is stated once instead of re-sent every turn.
+                baseInstructions: spec.instructions
             });
-            if (!deployedComms.ready) {
-                throw new Error(`comms email catch did not become ready on 127.0.0.1:${commsPort} in the subject sandbox`);
-            }
-            // Write the EMPTY inbox once up front so the persona's /inbox always resolves to the "No messages
-            // yet." page — never a bare 404 — the instant it navigates there, even before any mail arrives OR if
-            // the app sends to an address no declared recipient matches (the loop only re-renders on new mail).
-            await writeInboxSurface(desktop, deployedComms.surfaceDir, [], { originMap: commsOriginMap, requestTimeoutMs: deps.requestTimeoutMs });
-            const deployedRef = deployedComms;
-            surfaceLoop = (async () => {
-                // Render-first (so even a short session gets a populated inbox), then refresh on a cadence. The
-                // cadence uses a REAL timer, NOT the injected instant clock: this loop is unbounded, so an instant
-                // sleep would busy-spin and starve the session's own timers. The wait is interruptible by
-                // surfaceDispose (and the timer cleared) so teardown never blocks for a full cadence. Each refresh
-                // is a full, idempotent rebuild; `surfaceRenderedCount` only advances on a SUCCESSFUL render so a
-                // transient failure retries cleanly (no duplicate emails).
-                for (;;) {
-                    try {
-                        const refreshed = await refreshInboxSurface({
-                            desktop,
-                            deployed: deployedRef,
-                            recipients: surfaceRecipients,
-                            sinceCount: surfaceRenderedCount,
-                            originMap: commsOriginMap,
-                            requestTimeoutMs: deps.requestTimeoutMs
-                        });
-                        if (refreshed.rendered)
-                            surfaceRenderedCount = refreshed.count;
-                    }
-                    catch {
-                        // Never throw into the render loop; the teardown drain + by-id teardown must still run.
-                    }
-                    if (surfaceDisposed)
-                        break;
-                    await new Promise((resolve) => {
-                        const timer = setTimeout(resolve, INBOX_SURFACE_CADENCE_MS);
-                        void surfaceDispose.then(() => { clearTimeout(timer); resolve(); });
-                    });
-                    if (surfaceDisposed)
-                        break;
-                }
-            })();
-        }
-        // Per-lane geometry assertion (fail-closed) — the device claim is verified in-sandbox.
-        const screenGeometry = await inspectDesktopScreenGeometry({
-            desktop,
-            laneId: spec.laneId,
-            requestedScreen: spec.resolution,
-            requestTimeoutMs: deps.requestTimeoutMs
-        });
-        if (screenGeometry.verified) {
-            desktopGeometry = {
-                ...desktopGeometry,
-                screen: { ...desktopGeometry.screen, verified: screenGeometry.verified }
-            };
-        }
-        if (screenGeometry.warning) {
-            warnings.push(screenGeometry.warning);
-            desktopGeometry = { ...desktopGeometry, warnings: [screenGeometry.warning] };
-        }
-        if (screenGeometry.error && deps.screenMismatchPolicy !== "record-evidence") {
-            sessionError = screenGeometry.error;
-            failureCode = "HUMANISH_CUA_LAB_DEVICE_GEOMETRY";
-        }
-        else {
-            if (screenGeometry.error && screenGeometry.verified) {
-                // record-evidence policy: the bundle keeps requested vs verified as separate facts and
-                // discloses the divergence instead of failing this lane's world mid-flight.
-                const mismatchWarning = deps.scrubKnownValues(`Lane ${spec.laneId} requested a ${spec.resolution[0]}x${spec.resolution[1]} screen but xdpyinfo reports ${screenGeometry.verified.width}x${screenGeometry.verified.height}; recording requested vs verified separately instead of failing the lane closed.`);
-                warnings.push(mismatchWarning);
-                desktopGeometry = {
-                    ...desktopGeometry,
-                    warnings: [...(desktopGeometry.warnings ?? []), mismatchWarning]
-                };
-            }
-            if (desktopCliRoute) {
-                // Prepare the runtime and any declared product install, UNKEYED. With install omitted,
-                // the participant discovers and installs the product from its public surfaces.
-                await provisionDesktopCli(desktop, {
-                    product: config.subject.product?.name ?? "",
-                    ...(config.subject.product?.install === undefined ? {} : { install: config.subject.product.install }),
-                    requestTimeoutMs: deps.requestTimeoutMs,
-                    scrub: deps.scrubKnownValues,
-                    onPhase: onSubjectPhase
-                });
-            }
-            if (cloneRoute && serve && subjectRepo) {
-                subjectCommit = await provisionCloneSubject(desktop, {
-                    repo: subjectRepo,
-                    depth: config.subject.clone?.depth ?? 1,
-                    serve,
-                    ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
-                    hasGithubToken: deps.hasGithubToken,
-                    requestTimeoutMs: deps.requestTimeoutMs,
-                    scrub: deps.scrubKnownValues,
-                    onCommit: (commit) => {
-                        subjectCommit = commit;
-                    },
-                    onStateStep: (record) => {
-                        stateStepRecords.push(record);
-                    },
-                    onPhase: onSubjectPhase,
-                    ...(deps.hooks.detachedTimers ?? {})
-                });
-            }
-            else if (localTreeRoute && serve && deps.localTreeArchiveBuffer) {
-                await provisionLocalTreeSubject(desktop, {
-                    archiveBuffer: deps.localTreeArchiveBuffer,
-                    serve,
-                    ...(config.subject.state === undefined ? {} : { state: config.subject.state }),
-                    requestTimeoutMs: deps.requestTimeoutMs,
-                    scrub: deps.scrubKnownValues,
-                    onStateStep: (record) => {
-                        stateStepRecords.push(record);
-                    },
-                    onPhase: onSubjectPhase,
-                    ...(deps.hooks.detachedTimers ?? {})
+            localAgentProvider = appServer.provider;
+        }
+        else if (deps.localAgent === "claude") {
+            // One session for the whole run, like the codex thread above (#520). The one-shot
+            // provider (createLocalAgentProvider) spawned `claude -p` per turn, and every turn
+            // started with no memory of the last. HUMANISH_LOCAL_AGENT_ONE_SHOT=1 keeps that path
+            // reachable as a MEASUREMENT switch: MemTrapBench (2026-08) reports memory frameworks
+            // degrading agent performance by 10-40% on some tasks, so "remembers" has to be measured
+            // against "does not" on the same lab, not assumed. The trace records which one ran.
+            const oneShot = env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== undefined
+                && env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== ""
+                && env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== "0";
+            if (oneShot) {
+                localAgentProvider = createLocalAgentProvider({
+                    agent: "claude",
+                    ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
+                    ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model })
                 });
             }
-            if (!desktopCliRoute) {
-                const requestedFidelity = config.execution?.desktop?.fidelity;
-                // A declared camera (#509) is in place before the browser starts: the feed is generated or
-                // uploaded first, and a feed that cannot be produced fails the lane closed here.
-                const requestedMedia = config.execution?.desktop?.media;
-                const mediaEvidence = requestedMedia === undefined
-                    ? undefined
-                    : await prepareDesktopMedia(desktop, requestedMedia, config.policies?.mediaPermission ?? "prompt", deps.labCwd, deps.requestTimeoutMs);
-                const browserLaunch = await openDesktopBrowserTarget(desktop, targetUrl, deps.requestTimeoutMs, config.execution?.desktop?.browser, [
-                    ...(requestedFidelity?.mobileEmulation && spec.devicePreset.isMobile
-                        ? [
-                            `--user-agent=${requestedFidelity.userAgent ?? DEFAULT_MOBILE_USER_AGENT}`,
-                            ...(requestedFidelity.touch === false ? [] : ["--touch-events=enabled"])
-                        ]
-                        : []),
-                    ...(mediaEvidence?.flags ?? [])
-                ]);
-                desktopBrowser = mediaEvidence === undefined
-                    ? browserLaunch.evidence
-                    : { requested: config.execution?.desktop?.browser ?? "default", ...(browserLaunch.evidence ?? {}), media: mediaEvidence };
-                if (mediaEvidence !== undefined && browserLaunch.family !== "chromium") {
-                    throw new Error(`execution.desktop.media needs Chrome or Chromium on lane ${spec.laneId} (the fake-device flags are Chromium's); the launched browser family is ${browserLaunch.family}. Set execution.desktop.browser: chrome.`);
-                }
-                launchedBrowserFamily = browserLaunch.family;
-                browserLaunchIdentity = browserLaunch.identity;
-                browserLaunched = true;
-                await desktop.wait(BROWSER_SETTLE_MS).catch(() => undefined);
-                // Mobile fidelity beyond viewport size (#221): applied to the launch page before the
-                // geometry capture and the participant's first observation, OUTSIDE the stream/geometry
-                // try below (whose catch degrades to a warning): a request that cannot be applied fails
-                // the lane closed with the reason.
-                // Only lanes on a mobile preset are emulated: a run-wide flag must not hand a desktop or
-                // tablet lane an iPhone user agent (the first live proof did exactly that to the desktop
-                // newcomer beside the phone lane). Those lanes carry no fidelity block, which is honest.
-                const fidelityRequest = config.execution?.desktop?.fidelity;
-                if (fidelityRequest?.mobileEmulation && spec.devicePreset.isMobile) {
-                    if (launchedBrowserFamily !== "chromium") {
-                        throw new Error(`execution.desktop.fidelity.mobileEmulation needs Chrome or Chromium on lane ${spec.laneId}; the launched browser family is ${launchedBrowserFamily}. Set execution.desktop.browser: chrome.`);
-                    }
-                    const applied = await applyMobileEmulation(desktop, deps.requestTimeoutMs, {
-                        ...(browserLaunchIdentity?.cdpPort === undefined ? {} : { cdpPort: browserLaunchIdentity.cdpPort }),
-                        ...(browserLaunchIdentity?.profileDir === undefined ? {} : { profileDir: browserLaunchIdentity.profileDir }),
-                        targetUrl
-                    }, browserTargetId, {
-                        width: spec.devicePreset.width,
-                        height: spec.devicePreset.height,
-                        deviceScaleFactor: fidelityRequest.deviceScaleFactor ?? spec.devicePreset.deviceScaleFactor,
-                        touch: fidelityRequest.touch ?? true,
-                        userAgent: fidelityRequest.userAgent ?? DEFAULT_MOBILE_USER_AGENT
-                    });
-                    appliedFidelity = applied.fidelity;
-                    emulatedTargetId = applied.targetId;
-                    emulationHolderName = applied.holderName;
-                    warnings.push(...applied.warnings);
-                }
-            }
             else {
-                // A terminal window, opened the way the browser is opened on every other route: the
-                // participant arrives at a desktop with the thing they were asked to use already in front
-                // of them. They can still open another from the dock — that is the point of a desktop.
-                await openDesktopTerminal(desktop, deps.requestTimeoutMs, config.subject.product?.workdir);
-                await desktop.wait(BROWSER_SETTLE_MS).catch(() => undefined);
-            }
-            // Start the brain BEFORE the first screenshot: the app-server handshake is ~500ms, and it
-            // is paid here, while the sandbox is still settling, rather than inside turn one.
-            if (deps.localAgent === "codex") {
-                appServer = await startAppServerSession({
+                claudeSession = await startClaudeSession({
                     ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
-                    ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model }),
-                    // The persona lives on the THREAD, so it is stated once instead of re-sent every turn.
-                    baseInstructions: spec.instructions
+                    ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model })
                 });
-                localAgentProvider = appServer.provider;
-            }
-            else if (deps.localAgent === "claude") {
-                // One session for the whole run, like the codex thread above (#520). The one-shot
-                // provider (createLocalAgentProvider) spawned `claude -p` per turn, and every turn
-                // started with no memory of the last. HUMANISH_LOCAL_AGENT_ONE_SHOT=1 keeps that path
-                // reachable as a MEASUREMENT switch: MemTrapBench (2026-08) reports memory frameworks
-                // degrading agent performance by 10-40% on some tasks, so "remembers" has to be measured
-                // against "does not" on the same lab, not assumed. The trace records which one ran.
-                const oneShot = env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== undefined
-                    && env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== ""
-                    && env.HUMANISH_LOCAL_AGENT_ONE_SHOT !== "0";
-                if (oneShot) {
-                    localAgentProvider = createLocalAgentProvider({
-                        agent: "claude",
-                        ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
-                        ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model })
-                    });
-                }
-                else {
-                    claudeSession = await startClaudeSession({
-                        ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
-                        ...(config.actors[0]?.model === undefined ? {} : { model: config.actors[0].model })
-                    });
-                    localAgentProvider = claudeSession.provider;
-                }
-            }
-            // World is ready: release the pipeline gate so the remaining lanes may start.
-            provisioned = true;
-            signal(true);
-            try {
-                // No browser means no browser geometry, and none is invented: the CSS-viewport facts a
-                // browser reports have no counterpart in a terminal window, and an empty record shaped like
-                // a measurement would read as one. The screen geometry above is still verified.
-                if (!desktopCliRoute) {
-                    const browserGeometry = await captureDesktopBrowserGeometry({
-                        desktop,
-                        browserFamily: launchedBrowserFamily,
-                        ...(browserLaunchIdentity === undefined ? {} : { launchIdentity: browserLaunchIdentity }),
-                        laneId: spec.laneId,
-                        targetUrl,
-                        requestedScreen: spec.resolution,
-                        requestTimeoutMs: deps.requestTimeoutMs
-                    });
-                    initialBrowserGeometry = browserGeometry;
-                    browserWindowId = browserGeometry.browserWindowId;
-                    browserTargetId = browserGeometry.browserTargetId;
-                }
-                // The WHOLE desktop, not one window: a person studying a terminal app opens other windows,
-                // and a stream bound to the first one would quietly stop being evidence.
-                await startDesktopStream(desktop, browserWindowId);
-                const candidateStreamUrl = desktop.stream.getUrl({
-                    authKey: desktop.stream.getAuthKey(),
-                    autoConnect: true,
-                    viewOnly: true,
-                    resize: "scale"
-                });
-                if (typeof candidateStreamUrl === "string" && candidateStreamUrl.trim().length > 0) {
-                    streamUrl = candidateStreamUrl;
-                    await deps.hooks.onRuntimeStreamReady?.({
-                        laneId: spec.laneId,
-                        sandboxId: desktop.sandboxId,
-                        simId: spec.simId,
-                        streamId: spec.streamId,
-                        url: streamUrl
-                    });
-                }
-                else {
-                    warnings.push("Live desktop stream started but did not return a usable watch URL; Observer will fall back to screenshots.");
-                }
+                localAgentProvider = claudeSession.provider;
             }
-            catch (error) {
-                warnings.push(`Live desktop stream unavailable (run continues; evidence still captured): ${redactText(deps.scrubKnownValues(toErrorMessage(error)))}`);
-            }
-            // This is outside the stream's best-effort catch: unusable geometry is a harness failure,
-            // never a participant finding about missing controls. Both per-lane and concurrent seats
-            // use this route; sequential seats enforce the same capture result in shared-world-lab.
-            if (initialBrowserGeometry?.unusable !== undefined) {
-                failureCode = "HUMANISH_CUA_LAB_DEVICE_GEOMETRY";
-                throw new Error(`${failureCode}: ${initialBrowserGeometry.unusable} Participant actions were not started.`);
-            }
-            // The FAIL-CLOSED spend cap (execution.caps.maxUsd) is wired into the loop as maxUsd + an
-            // injected pure per-turn estimator keyed on the resolved model. Preflight already refused a
-            // cap on an unpriced model, so the estimate is measurable whenever a cap is in force. The
-            // model id here matches provider.version (openai-responses-cu resolves the default when unset).
-            const capModelId = config.actors[0]?.model ?? DEFAULT_OPENAI_CU_MODEL;
-            const maxUsd = config.execution?.caps?.maxUsd;
-            const sessionOptions = {
-                // Tell the persona where its inbox is — but only when comms is live AND this lane has a declared
-                // recipient it can actually receive mail into (else it would stall on an inbox that stays
-                // empty). Two comms planes, mutually exclusive by parse: the in-sandbox catch humanish
-                // deployed, or the adopter-hosted one (#380).
-                instructions: deps.receiving && receivingInboxUrl
-                    ? withInboxMission(spec, receivingInboxUrl, deps.receiving.address(spec.laneId), true).instructions
-                    : commsEmail && commsInboxUrl && deployedComms?.ready && laneHasInboxRecipient(commsEmail, spec.laneId)
-                        ? withInboxMission(spec, commsInboxUrl, inboxRecipientFor(commsEmail, spec.laneId)?.address).instructions
-                        : deps.externalComms && laneHasInboxRecipient(deps.externalComms.email, spec.laneId)
-                            ? withInboxMission(spec, deps.externalComms.inboxUrl, inboxRecipientFor(deps.externalComms.email, spec.laneId)?.address).instructions
-                            : spec.instructions,
-                persona: spec.persona,
-                timeoutMs: deps.timeoutMs,
-                // The brain is either a keyed API client or a CLI the operator is already signed in to.
-                // Everything below this line — loop, executor, trace, affordances — is identical either
-                // way, which is what makes a local-agent run comparable to an API one.
-                ...(localAgentProvider === undefined ? {} : { provider: localAgentProvider }),
-                openai: {
-                    apiKey: deps.openaiApiKey,
-                    ...(config.actors[0]?.model ? { model: config.actors[0].model } : {}),
-                    // Per-LANE, not per-actor: two lanes at different efforts is the control this exists for.
-                    ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
-                    ...(spec.maxOutputTokens === undefined ? {} : { maxOutputTokens: spec.maxOutputTokens })
-                },
-                ...(maxUsd === undefined
-                    ? {}
-                    : {
-                        maxUsd,
-                        estimateTurnCostUsd: (usage) => estimateActorCost(usage, capModelId).estimatedCostUsd
-                    }),
-                desktop: desktop,
-                ...(launchedBrowserFamily === "chromium"
-                    ? {
-                        executorOptions: {
-                            observeBrowserState: makeChromeBrowserStateObserver(desktop, deps.requestTimeoutMs, {
-                                ...(browserLaunchIdentity?.cdpPort === undefined ? {} : { cdpPort: browserLaunchIdentity.cdpPort }),
-                                ...(browserLaunchIdentity?.profileDir === undefined ? {} : { profileDir: browserLaunchIdentity.profileDir }),
-                                targetUrl
-                            }, browserTargetId, 
-                            // Once per lane: a dark observation channel is a gap in the instrument, and the
-                            // funnel's NEVER MEASURED count needs this line to explain itself (#514).
-                            (reason) => {
-                                warnings.push(`Browser-state observer unavailable for lane ${spec.laneId} (${redactText(deps.scrubKnownValues(reason))}); ` +
-                                    "urlIncludes/urlPathEquals/textIncludes stop conditions and task criteria are NOT being measured this session.");
-                            }, emulatedTargetId === undefined
-                                ? undefined
-                                : {
-                                    emulatedTargetId,
-                                    expectedWidth: spec.devicePreset.width,
-                                    expectTouch: appliedFidelity?.requested.touch === true,
-                                    onDrift: (reason) => {
-                                        warnings.push(`Mobile emulation drift on lane ${spec.laneId}: ${reason} (#623).`);
-                                    },
-                                    onCovered: (coveredTargetId, read) => {
-                                        // A later tab the page itself reported at the phone width: evidence that
-                                        // the emulation followed the participant (#623), kept on the bundle.
-                                        if (appliedFidelity === undefined)
-                                            return;
-                                        appliedFidelity = {
-                                            ...appliedFidelity,
-                                            laterTargets: [...(appliedFidelity.laterTargets ?? []), { targetId: coveredTargetId, ...read }]
-                                        };
-                                    }
-                                })
-                        }
-                    }
-                    : {}),
-                redactScreenshots: deps.redactScreenshots,
-                scrubText: deps.scrubKnownValues,
-                writeScreenshot,
-                ...(spec.idleSteps === undefined ? {} : { idleSteps: spec.idleSteps }),
-                ...(spec.noProgressSteps === undefined ? {} : { noProgressSteps: spec.noProgressSteps }),
-                ...(spec.stopWhen === undefined ? {} : { stopWhen: spec.stopWhen }),
-                ...(spec.dwell === undefined ? {} : { dwell: spec.dwell }),
-                ...(spec.tasks === undefined ? {} : { tasks: spec.tasks }),
-                // The STUDY budget (#299): this lane notes its own running estimate on the shared ledger
-                // and stops when the RUN total crosses the cap — independent of the per-lane maxUsd above.
-                ...(deps.runBudget === undefined
-                    ? {}
-                    : {
-                        overRunBudget: (usage) => {
-                            const estimate = estimateActorCost(usage, capModelId).estimatedCostUsd;
-                            const totalUsd = deps.runBudget.note(spec.laneId, estimate);
-                            return totalUsd > deps.runBudget.maxTotalUsd
-                                ? `study budget reached: the run's estimated model spend $${round6(totalUsd)} crossed execution.caps.maxTotalUsd=$${deps.runBudget.maxTotalUsd}; this lane stops here and sibling lanes stop at their next turn`
-                                : null;
-                        }
-                    }),
-                ...(deps.onObservedUrl === undefined ? {} : { onObservedUrl: deps.onObservedUrl }),
-                ...(deps.onMessage === undefined ? {} : { onMessage: deps.onMessage }),
-                ...(deps.onScreenshot === undefined ? {} : { onScreenshot: deps.onScreenshot }),
-                ...(deps.onTrace === undefined
-                    ? {}
-                    : {
-                        // Forwards the RUNNING usage as well: the lane is where both are known, and usage
-                        // without it never reaches the flush — which is how the live cost stayed unknown.
-                        onTrace: (items, usage) => deps.onTrace?.(spec.laneId, items, usage)
-                    })
-            };
-            session = await deps.runSession(sessionOptions);
         }
+        // World is ready: release the pipeline gate so the remaining lanes may start.
+        provisioned = true;
+        signal(true);
+        const ready = await desktopLane.openSession();
+        // The FAIL-CLOSED spend cap (execution.caps.maxUsd) is wired into the loop as maxUsd + an
+        // injected pure per-turn estimator keyed on the resolved model. Preflight already refused a
+        // cap on an unpriced model, so the estimate is measurable whenever a cap is in force. The
+        // model id here matches provider.version (openai-responses-cu resolves the default when unset).
+        const capModelId = config.actors[0]?.model ?? DEFAULT_OPENAI_CU_MODEL;
+        const maxUsd = config.execution?.caps?.maxUsd;
+        const sessionOptions = {
+            instructions: ready.inbox
+                ? withInboxMission(spec, ready.inbox.url, ready.inbox.address, ready.inbox.receiving).instructions
+                : spec.instructions,
+            persona: spec.persona,
+            timeoutMs: deps.timeoutMs,
+            // The brain is either a keyed API client or a CLI the operator is already signed in to.
+            // Everything below this line — loop, executor, trace, affordances — is identical either
+            // way, which is what makes a local-agent run comparable to an API one.
+            ...(localAgentProvider === undefined ? {} : { provider: localAgentProvider }),
+            openai: {
+                apiKey: deps.openaiApiKey,
+                ...(config.actors[0]?.model ? { model: config.actors[0].model } : {}),
+                // Per-LANE, not per-actor: two lanes at different efforts is the control this exists for.
+                ...(spec.reasoningEffort === undefined ? {} : { reasoningEffort: spec.reasoningEffort }),
+                ...(spec.maxOutputTokens === undefined ? {} : { maxOutputTokens: spec.maxOutputTokens })
+            },
+            ...(maxUsd === undefined
+                ? {}
+                : {
+                    maxUsd,
+                    estimateTurnCostUsd: (usage) => estimateActorCost(usage, capModelId).estimatedCostUsd
+                }),
+            executor: ready.executor,
+            redactScreenshots: deps.redactScreenshots,
+            scrubText: deps.scrubKnownValues,
+            writeScreenshot,
+            ...(spec.idleSteps === undefined ? {} : { idleSteps: spec.idleSteps }),
+            ...(spec.noProgressSteps === undefined ? {} : { noProgressSteps: spec.noProgressSteps }),
+            ...(spec.stopWhen === undefined ? {} : { stopWhen: spec.stopWhen }),
+            ...(spec.dwell === undefined ? {} : { dwell: spec.dwell }),
+            ...(spec.tasks === undefined ? {} : { tasks: spec.tasks }),
+            // The STUDY budget (#299): this lane notes its own running estimate on the shared ledger
+            // and stops when the RUN total crosses the cap — independent of the per-lane maxUsd above.
+            ...(deps.runBudget === undefined
+                ? {}
+                : {
+                    overRunBudget: (usage) => {
+                        const estimate = estimateActorCost(usage, capModelId).estimatedCostUsd;
+                        const totalUsd = deps.runBudget.note(spec.laneId, estimate);
+                        return totalUsd > deps.runBudget.maxTotalUsd
+                            ? `study budget reached: the run's estimated model spend $${round6(totalUsd)} crossed execution.caps.maxTotalUsd=$${deps.runBudget.maxTotalUsd}; this lane stops here and sibling lanes stop at their next turn`
+                            : null;
+                    }
+                }),
+            ...(deps.onObservedUrl === undefined ? {} : { onObservedUrl: deps.onObservedUrl }),
+            ...(deps.onMessage === undefined ? {} : { onMessage: deps.onMessage }),
+            ...(deps.onScreenshot === undefined ? {} : { onScreenshot: deps.onScreenshot }),
+            ...(deps.onTrace === undefined
+                ? {}
+                : {
+                    // Forwards the RUNNING usage as well: the lane is where both are known, and usage
+                    // without it never reaches the flush — which is how the live cost stayed unknown.
+                    onTrace: (items, usage) => deps.onTrace?.(spec.laneId, items, usage)
+                })
+        };
+        session = await deps.runSession(sessionOptions);
     }
     catch (error) {
         sessionError = redactText(deps.scrubKnownValues(toErrorMessage(error)));
     }
     finally {
-        // The local brain owns a process. Close it before anything else can throw: a leaked
-        // app-server per lane would outlive the run and keep a thread open on the operator's plan.
-        appServer?.close();
-        await claudeSession?.close();
-        // Stop the mid-run inbox-surface loop FIRST — before the teardown evidence drain below — so the two
-        // `cat`s never overlap and the final surface state is deterministic. A surface failure can never
-        // block teardown (the loop body is fully try/caught and this await is on its already-caught promise).
-        surfaceDisposed = true;
-        releaseSurface();
-        if (surfaceLoop)
-            await surfaceLoop.catch(() => undefined);
-        if (!provisioned) {
-            signal(false);
+        try {
+            appServer?.close();
         }
-        if (desktop && desktopModule) {
-            if (browserLaunched) {
-                const finalGeometry = await captureDesktopBrowserGeometry({
-                    desktop,
-                    browserFamily: launchedBrowserFamily,
-                    ...(browserLaunchIdentity === undefined ? {} : { launchIdentity: browserLaunchIdentity }),
-                    ...(browserWindowId === undefined ? {} : { browserWindowId }),
-                    ...(browserTargetId === undefined ? {} : { browserTargetId }),
-                    laneId: spec.laneId,
-                    targetUrl,
-                    requestedScreen: spec.resolution,
-                    requestTimeoutMs: deps.requestTimeoutMs,
-                    pagePreference: "active",
-                    resize: false
-                }).catch((error) => ({
-                    warnings: [`Final browser geometry measurement failed for lane ${spec.laneId}: ${redactText(deps.scrubKnownValues(toErrorMessage(error)))}`]
-                }));
-                // Chosen capture rule: final-if-it-measured-anything, else launch-time. A final capture
-                // that measured EITHER field wins whole, so a partial final capture omits fields the
-                // launch-time capture had (honest omission); only a final capture that measured NOTHING
-                // falls back to the launch-time capture.
-                const chosenGeometry = finalGeometry.browserWindow !== undefined || finalGeometry.viewport !== undefined
-                    ? finalGeometry
-                    : initialBrowserGeometry ?? finalGeometry;
-                const geometryWarnings = [...new Set([...(initialBrowserGeometry?.warnings ?? []), ...chosenGeometry.warnings].map((warning) => deps.scrubKnownValues(warning)))];
-                warnings.push(...geometryWarnings);
-                // The emulation holder's own log, after its announce line: which later targets it
-                // attached to, what it sent, and any reply that came back as an error (#623). Read while
-                // the sandbox is alive; the first live proof had no way to say what the holder did.
-                if (appliedFidelity !== undefined && emulationHolderName !== undefined) {
-                    const holderLog = await readDetachedLog(desktop, emulationHolderName, deps.requestTimeoutMs).catch(() => "");
-                    const lines = holderLog.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{")).slice(1, 51);
-                    if (lines.length > 0)
-                        appliedFidelity = { ...appliedFidelity, holderLog: lines.map((line) => deps.scrubKnownValues(line)) };
-                }
-                desktopGeometry = {
-                    screen: desktopGeometry.screen,
-                    ...(chosenGeometry.browserWindow === undefined ? {} : { browserWindow: chosenGeometry.browserWindow }),
-                    ...(chosenGeometry.viewport === undefined ? {} : { viewport: chosenGeometry.viewport }),
-                    ...(appliedFidelity === undefined ? {} : { fidelity: appliedFidelity }),
-                    ...((desktopGeometry.warnings?.length ?? 0) + geometryWarnings.length === 0
-                        ? {}
-                        : { warnings: [...(desktopGeometry.warnings ?? []), ...geometryWarnings] })
-                };
-            }
-            if (deps.receiving) {
-                try {
-                    await deps.receiving.finishParticipant(spec.laneId);
-                }
-                catch {
-                    warnings.push("Real email finalization is incomplete. Inspect communication cleanup with humanish comms recover.");
-                }
-            }
-            // Off-app comms evidence (#297): before this lane's sandbox is torn down, drain everything the
-            // in-sandbox catch captured, route it into a host fake inbox addressed to the declared
-            // recipients, and write the digest-only thread artifact. Wrapped so a drain failure NEVER
-            // breaks teardown — the sandbox must still be killed either way. Runs only for a ready catch.
-            if (commsEmail && deployedComms?.ready) {
-                try {
-                    const commsChannel = new FakeInbox();
-                    const commsInboxes = [];
-                    for (const recipient of commsEmail.recipients ?? []) {
-                        if (recipient.address !== undefined) {
-                            commsInboxes.push(await commsChannel.provisionAddress(recipient.lane, recipient.address));
-                        }
-                    }
-                    const collected = await collectCommsThread({
-                        desktop,
-                        deployed: deployedComms,
-                        channel: commsChannel,
-                        inboxes: commsInboxes,
-                        requestTimeoutMs: deps.requestTimeoutMs
-                    });
-                    if (collected.artifact) {
-                        const path = deps.laneCount === 1 ? "comms/thread.json" : `comms/${spec.streamId}.thread.json`;
-                        await writeContainedOutputFile(deps.artifactRoot, path, `${JSON.stringify(collected.artifact, null, 2)}\n`, "utf8");
-                        commsArtifactPath = path;
-                    }
-                    else if (collected.captured > 0) {
-                        // Captured mail that matched no declared recipient must not vanish silently (invariant 6:
-                        // honest signals): tell the operator to declare comms.email.recipients[].address to match
-                        // the address the app actually sends to (e.g. the one the persona surface will sign up with).
-                        warnings.push(`Comms catch captured ${collected.captured} email send(s) but none matched a declared recipient inbox — no comms evidence written. Declare comms.email.recipients[].address to match the address the app sends to.`);
-                    }
-                    else {
-                        // Zero captures is the silent-broken shape (#351): the app never posted to the catch at
-                        // all, so the personas stared at an empty inbox. Most common cause: the app does not
-                        // actually read the declared injectEnv var for its email API base URL.
-                        const transportHint = commsEmail.smtp
-                            ? `Verify the app reads ${commsEmail.smtp.hostEnv}/${commsEmail.smtp.portEnv} for its SMTP host and port`
-                            : `Verify the app reads ${commsEmail.injectEnv} for its email API base URL (an SDK that ignores it sends real mail or throws)`;
-                        warnings.push(`Comms catch captured ZERO email sends — the app never delivered mail through the catch. ${transportHint} and that the flow reached an email step.`);
-                    }
-                }
-                catch (error) {
-                    warnings.push(`Comms evidence collection failed (run continues; sandbox still torn down): ${redactText(deps.scrubKnownValues(toErrorMessage(error)))}`);
-                }
-            }
-            const failed = sessionError !== undefined || session === undefined;
-            // Each route's own keep flag gates its own lane only: a clone.keep can never leak into
-            // a local-tree lane's teardown decision, and vice versa.
-            const keepReason = cloneRoute && config.subject.clone?.keep === true
-                ? "subject.clone.keep"
-                : localTreeRoute && config.subject.localTree?.keep === true
-                    ? "subject.localTree.keep"
-                    : undefined;
-            const keepForDebug = keepReason !== undefined && failed;
-            if (keepForDebug) {
-                warnings.push(`Sandbox ${desktop.sandboxId} kept for debugging (${keepReason} on failure); reclaim it via E2B or it will be killed on its server-side timeout.`);
-            }
-            else if (typeof desktopModule.Sandbox.kill === "function") {
-                try {
-                    await desktopModule.Sandbox.kill(desktop.sandboxId, { requestTimeoutMs: 60_000 });
-                    killed = true;
-                }
-                catch (error) {
-                    warnings.push(`Sandbox teardown failed (server-side kill-on-timeout will reclaim it): ${redactText(deps.scrubKnownValues(toErrorMessage(error)))}`);
-                }
-            }
-            else {
-                warnings.push("Installed @e2b/desktop SDK does not expose Sandbox.kill; server-side kill-on-timeout will reclaim the sandbox.");
-            }
-            // Close the observed span. A kept or unconfirmed sandbox can still accrue compute cost;
-            // the summary records that remaining lifetime as unknown instead of calling this complete.
-            sandboxTornDownAtMs = deps.now();
-            // The lane's live stream is now a dead page whichever teardown path ran (killed, kept, or
-            // kill-failed-awaiting-TTL) — tell the watch overlay so the tile falls back to recorded
-            // evidence instead of "sandbox not found" (#357). Guarded: a viewer callback must never
-            // break teardown.
-            if (streamUrl !== undefined) {
-                try {
-                    await deps.hooks.onRuntimeStreamEnded?.({ laneId: spec.laneId, simId: spec.simId, streamId: spec.streamId });
-                }
-                catch {
-                    // viewer-side only; nothing to record
-                }
-            }
+        catch {
+            warnings.push('Codex session cleanup failed; desktop cleanup will still run.');
+        }
+        try {
+            await claudeSession?.close();
+        }
+        catch {
+            warnings.push('Claude session cleanup failed; desktop cleanup will still run.');
+        }
+        try {
+            if (!provisioned)
+                signal(false);
+        }
+        finally {
+            await desktopLane.finalize({ failed: sessionError !== undefined || session === undefined });
         }
     }
-    // Host-side approximation of the E2B desktop's billed lifetime; feeds the desktop-minute cost
-    // estimate. Never negative.
-    const desktopDurationMs = sandboxCreatedAtMs !== undefined && sandboxTornDownAtMs !== undefined
-        ? Math.max(0, sandboxTornDownAtMs - sandboxCreatedAtMs)
-        : undefined;
     if (session) {
         // Per-lane model-token cost ESTIMATE, attached to the trace before it is persisted (the model
         // id is authoritative here — provider.version). Kept at the lab boundary so the pure loop
@@ -2419,24 +928,13 @@ export async function runCuaLane(spec, deps) {
         spec,
         ...(session ? { session } : {}),
         ...(sessionError === undefined ? {} : { sessionError }),
-        ...(sandboxId === undefined ? {} : { sandboxId }),
-        ...(desktopDurationMs === undefined ? {} : { desktopDurationMs }),
-        ...(desktopResources === undefined ? {} : { desktopResources }),
-        killed,
-        streamUrlPresent: streamUrl !== undefined,
+        ...desktopLane.snapshot(),
         screenshots,
-        ...(subjectCommit === undefined ? {} : { subjectCommit }),
-        ...(desktopBrowser === undefined ? {} : { desktopBrowser }),
-        desktopGeometry,
-        stateStepRecords,
-        phaseRecords,
         warnings,
         noEngagement,
         selfReportedBlocker,
         reportedFriction,
         harnessError,
-        ...(failureCode === undefined ? {} : { failureCode }),
-        ...(commsArtifactPath === undefined ? {} : { commsArtifactPath })
     };
 }
 /** Run the single IN-PROCESS lane (a custom executor + provider; NO E2B). Always one lane. */
@@ -3763,300 +2261,6 @@ function buildSingleLaneBundle(args) {
         phaseEvents: outcome?.phaseRecords ?? []
     });
 }
-/**
- * Shared post-populate provisioning pipeline (clone AND local-tree routes): (install) ->
- * state(before-build) -> (build) -> state(before-start) -> detached start -> readiness probe ->
- * state(after-ready). Both provisioning routes populate SUBJECT_DIR by different means (git
- * clone vs. upload+extract) and then run this identical pipeline unchanged.
- *
- * State steps run through the same detached primitive as serve steps (author-trusted, the
- * "serve commands are author-trusted" corollary) under the reserved `subject-state-<name>`
- * label prefix, so a step name can never collide with subject-clone/subject-extract/install/
- * build/start. after-ready steps complete BEFORE the caller opens the browser: the actor never
- * drives a half-seeded subject and seeding never eats the session budget.
- */
-async function runSubjectServePipeline(desktop, args) {
-    const timers = {
-        ...(args.now === undefined ? {} : { now: args.now }),
-        ...(args.sleep === undefined ? {} : { sleep: args.sleep })
-    };
-    const now = args.now ?? Date.now;
-    const refresh = args.onPhaseComplete ?? (() => Promise.resolve());
-    const stateSteps = args.state?.seed ?? [];
-    const runStateSteps = async (when) => {
-        const steps = stateSteps.filter((step) => (step.when ?? "before-start") === when);
-        if (steps.length === 0) {
-            // No declared steps for this group: no boundary to report (avoids empty-group noise on
-            // every run, since before-build/before-start/after-ready are always called).
-            return;
-        }
-        const groupStartedAt = now();
-        emitPhaseStarted(args.onPhase, now, `state.${when}`, `running subject state seed steps (${when})`);
-        for (const step of steps) {
-            const stepTimeoutMs = step.timeoutMs ?? DEFAULT_STATE_STEP_TIMEOUT_MS;
-            const startedAt = now();
-            const result = await runDetachedStep(desktop, {
-                name: `subject-state-${step.name}`,
-                command: step.command,
-                cwd: SUBJECT_DIR,
-                timeoutMs: stepTimeoutMs,
-                requestTimeoutMs: args.requestTimeoutMs,
-                ...timers
-            });
-            args.onStateStep?.({
-                name: step.name,
-                when,
-                // Digest only (sha256-16): the command text never persists: the lab YAML in the
-                // consumer's repo is the plaintext source of truth.
-                commandDigest: commandDigestOf(step.command),
-                ok: result.ok,
-                ...(result.exitCode === undefined ? {} : { exitCode: result.exitCode }),
-                ...(result.timedOut ? { timedOut: true } : {}),
-                durationMs: Math.max(0, now() - startedAt)
-            });
-            if (!result.ok) {
-                emitPhaseCompleted(args.onPhase, now, groupStartedAt, `state.${when}`, false, `subject state seed steps failed (${when})`);
-                // Fail closed with the existing scrub-before-truncate tail chain: literal scrub of
-                // every provisioned value PRE-truncation, then pattern redaction + cap in tailOf.
-                throw new Error(`subject state step "${step.name}" ${result.timedOut ? `timed out after ${stepTimeoutMs}ms` : `failed (exit ${result.exitCode})`}: ${tailOf(args.scrub(result.logTail))}`);
-            }
-        }
-        emitPhaseCompleted(args.onPhase, now, groupStartedAt, `state.${when}`, true, `subject state seed steps complete (${when})`);
-    };
-    // Provide the runtime the pipeline needs before running it (#371). The stock desktop template
-    // ships python3 and curl but no Node, so an `npm install` here used to die at exit 127 after the
-    // sandbox was already paid for. Probe-first, so a template that ships its own Node pays nothing.
-    const serveCommands = [args.serve.install, args.serve.build, args.serve.start];
-    if (needsNodeRuntime(serveCommands)) {
-        const runtimeStartedAt = now();
-        emitPhaseStarted(args.onPhase, now, "runtime", "providing the Node runtime the serve pipeline needs");
-        const bootstrap = await runProvisioningStepWithOneRetry(desktop, {
-            name: "subject-runtime-node",
-            command: nodeBootstrapCommand(),
-            cwd: SUBJECT_DIR,
-            timeoutMs: args.serve.installTimeoutMs ?? INSTALL_TIMEOUT_MS,
-            requestTimeoutMs: args.requestTimeoutMs,
-            timers,
-            retryPhase: "runtime-retry",
-            retryMessage: "Node runtime bootstrap",
-            onPhase: args.onPhase,
-            now
-        });
-        let ok = bootstrap.ok;
-        const corepack = ok ? corepackCommandFor(serveCommands) : undefined;
-        if (corepack) {
-            const pm = await runDetachedStep(desktop, {
-                name: "subject-runtime-pm",
-                command: corepack,
-                cwd: SUBJECT_DIR,
-                timeoutMs: args.serve.installTimeoutMs ?? INSTALL_TIMEOUT_MS,
-                requestTimeoutMs: args.requestTimeoutMs,
-                ...timers
-            });
-            ok = pm.ok;
-        }
-        emitPhaseCompleted(args.onPhase, now, runtimeStartedAt, "runtime", ok, ok ? "Node runtime ready" : "could not provide a Node runtime");
-        if (!ok) {
-            throw new Error(`the subject's serve pipeline needs a Node runtime and this desktop template has none, and bootstrapping one failed${bootstrap.attempts === 2 ? " twice" : ""}: ${tailOf(args.scrub(bootstrap.logTail))}. Use execution.desktop.template with an image that ships Node, or change serve.install to a runtime the template provides.`);
-        }
-    }
-    if (args.serve.install) {
-        const installStartedAt = now();
-        emitPhaseStarted(args.onPhase, now, "install", "installing subject dependencies");
-        const install = await runProvisioningStepWithOneRetry(desktop, {
-            name: "subject-install",
-            command: args.serve.install,
-            cwd: SUBJECT_DIR,
-            timeoutMs: args.serve.installTimeoutMs ?? INSTALL_TIMEOUT_MS,
-            requestTimeoutMs: args.requestTimeoutMs,
-            timers,
-            retryPhase: "install-retry",
-            retryMessage: "subject install",
-            onPhase: args.onPhase,
-            now
-        });
-        emitPhaseCompleted(args.onPhase, now, installStartedAt, "install", install.ok, install.ok
-            ? install.attempts === 2
-                ? "subject dependencies installed (on the second attempt)"
-                : "subject dependencies installed"
-            : install.attempts === 2
-                ? "subject install failed twice"
-                : "subject install failed");
-        if (!install.ok) {
-            // Lead with the line a person can act on; npm's own trace follows it (#602).
-            const headline = install.timedOut
-                ? `subject install timed out after ${args.serve.installTimeoutMs ?? INSTALL_TIMEOUT_MS}ms`
-                : install.attempts === 2
-                    ? `subject install failed twice (exit ${install.firstExitCode ?? "null"}, then exit ${install.exitCode ?? "null"}); the sandbox could not complete serve.install`
-                    : `subject install failed (exit ${install.exitCode ?? "null"})`;
-            throw new Error(`${headline}: ${tailOf(args.scrub(install.logTail))}`);
-        }
-        await refresh();
-    }
-    // before-build: after install, before build (builds that read seeded state, e.g. SSG).
-    // When no build is declared this simply precedes start: equivalent to before-start.
-    await runStateSteps("before-build");
-    await refresh();
-    if (args.serve.build) {
-        const buildStartedAt = now();
-        emitPhaseStarted(args.onPhase, now, "build", "building subject");
-        const build = await runDetachedStep(desktop, {
-            name: "subject-build",
-            command: args.serve.build,
-            cwd: SUBJECT_DIR,
-            timeoutMs: args.serve.buildTimeoutMs ?? BUILD_TIMEOUT_MS,
-            requestTimeoutMs: args.requestTimeoutMs,
-            ...timers
-        });
-        emitPhaseCompleted(args.onPhase, now, buildStartedAt, "build", build.ok, build.ok ? "subject build complete" : "subject build failed");
-        if (!build.ok) {
-            throw new Error(`subject build ${build.timedOut ? "timed out" : `failed (exit ${build.exitCode})`}: ${tailOf(args.scrub(build.logTail))}`);
-        }
-        await refresh();
-    }
-    // before-start (the default phase): migrations, SQL/file fixtures, an in-sandbox DB server
-    // (`sudo service postgresql start && pg_isready` is a bounded step; the daemon it forks is
-    // reclaimed by the sandbox lifecycle like everything else).
-    await runStateSteps("before-start");
-    await refresh();
-    await startDetachedProcess(desktop, {
-        name: "subject-start",
-        command: args.serve.start,
-        cwd: SUBJECT_DIR,
-        requestTimeoutMs: args.requestTimeoutMs
-    });
-    // Fire-and-forget: startDetachedProcess never waits for the long-lived server to exit, so
-    // there is no matching completed event here (no ok/durationMs to report yet); readiness is
-    // the next boundary.
-    args.onPhase?.({ at: isoNow(now), type: "cua-lab.subject.serve.started", message: "subject server launched (detached)" });
-    const readyStartedAt = now();
-    emitPhaseStarted(args.onPhase, now, "ready", "waiting for subject to become ready");
-    const ready = await probeUrl(desktop, args.serve.url, {
-        timeoutMs: args.serve.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
-        requestTimeoutMs: args.requestTimeoutMs,
-        ...timers
-    });
-    emitPhaseCompleted(args.onPhase, now, readyStartedAt, "ready", ready, ready ? "subject is ready" : "subject did not become ready in time");
-    if (!ready) {
-        const startLog = await readDetachedLog(desktop, "subject-start", args.requestTimeoutMs).catch(() => "");
-        throw new Error(`subject did not answer at ${args.serve.url} within ${args.serve.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS}ms; server log tail: ${tailOf(args.scrub(startLog))}`);
-    }
-    // after-ready: fixture loading through the RUNNING app (loopback curl from in-sandbox:
-    // steps are author-trusted provisioning, not actors, so no new URL policy surface). These
-    // complete before the caller opens the browser and the session timer starts.
-    await runStateSteps("after-ready");
-    await refresh();
-}
-/**
- * Provision a clone subject inside the sandbox: clone → the shared serve pipeline
- * (install → state(before-build) → build → state(before-start) → start → readiness
- * probe → state(after-ready)). Returns the latest subject HEAD after successful
- * provisioning. Throws (with a capped log tail for the caller to redact) on any failing step:
- * the lab persists that as a failed-evidence bundle.
- *
- * Auth: when GITHUB_TOKEN is among the declared subject env names, the clone authenticates
- * via an Authorization header computed IN-SANDBOX from the provisioned env: the token never
- * appears in the script text, the process argv beyond the transient git call, the clone URL,
- * or .git/config.
- */
-export async function provisionCloneSubject(desktop, args) {
-    const timers = {
-        ...(args.now === undefined ? {} : { now: args.now }),
-        ...(args.sleep === undefined ? {} : { sleep: args.sleep })
-    };
-    const now = args.now ?? Date.now;
-    let latestCommit;
-    const refreshCommit = async () => {
-        const head = await desktop.commands.run(`git -C ${SUBJECT_DIR} rev-parse HEAD 2>/dev/null || true`, { requestTimeoutMs: args.requestTimeoutMs });
-        const commit = (head.stdout ?? "").trim() || undefined;
-        if (commit) {
-            latestCommit = commit;
-            args.onCommit?.(commit);
-        }
-    };
-    const cloneCommand = args.hasGithubToken
-        ? `auth=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0) && git -c http.extraHeader="Authorization: Basic $auth" clone --depth ${args.depth} https://github.com/${args.repo}.git ${SUBJECT_DIR}`
-        : `git clone --depth ${args.depth} https://github.com/${args.repo}.git ${SUBJECT_DIR}`;
-    const cloneStartedAt = now();
-    emitPhaseStarted(args.onPhase, now, "clone", "cloning subject repository");
-    const clone = await runDetachedStep(desktop, {
-        name: "subject-clone",
-        command: cloneCommand,
-        timeoutMs: CLONE_TIMEOUT_MS,
-        requestTimeoutMs: args.requestTimeoutMs,
-        ...timers
-    });
-    emitPhaseCompleted(args.onPhase, now, cloneStartedAt, "clone", clone.ok, clone.ok ? "subject repository cloned" : "subject clone failed");
-    if (!clone.ok) {
-        throw new Error(`subject clone ${clone.timedOut ? "timed out" : `failed (exit ${clone.exitCode})`}: ${tailOf(args.scrub(clone.logTail))}`);
-    }
-    await refreshCommit();
-    await runSubjectServePipeline(desktop, {
-        serve: args.serve,
-        ...(args.state === undefined ? {} : { state: args.state }),
-        requestTimeoutMs: args.requestTimeoutMs,
-        scrub: args.scrub,
-        ...(args.onStateStep === undefined ? {} : { onStateStep: args.onStateStep }),
-        ...(args.onPhase === undefined ? {} : { onPhase: args.onPhase }),
-        onPhaseComplete: refreshCommit,
-        ...timers
-    });
-    return latestCommit;
-}
-/**
- * Provision a local-tree subject inside the sandbox: upload the once-per-run packed archive
- * (identical bytes across every fan-out lane) → extract it into SUBJECT_DIR → the
- * same shared serve pipeline provisionCloneSubject uses. Unlike the clone route there is no
- * in-sandbox git refresh: the archive excludes .git entirely (see source-archive.ts), so
- * subject identity is the host-side LocalTreeArchive captured at pack time, never anything
- * resolved in-sandbox.
- */
-export async function provisionLocalTreeSubject(desktop, args) {
-    const timers = {
-        ...(args.now === undefined ? {} : { now: args.now }),
-        ...(args.sleep === undefined ? {} : { sleep: args.sleep })
-    };
-    const now = args.now ?? Date.now;
-    const uploadStartedAt = now();
-    emitPhaseStarted(args.onPhase, now, "upload", "uploading packed local-tree archive");
-    try {
-        await withOneRetryOnTransientE2BError(() => desktop.files.write(LOCAL_TREE_REMOTE_ARCHIVE_PATH, args.archiveBuffer, {
-            requestTimeoutMs: args.requestTimeoutMs,
-            useOctetStream: true
-        }), {
-            onRetry: (reason) => emitPhaseStarted(args.onPhase, now, "upload-retry", `local-tree archive upload retried once (${tailOf(args.scrub(reason))})`),
-            ...(args.sleep === undefined ? {} : { sleep: args.sleep })
-        });
-    }
-    catch (error) {
-        emitPhaseCompleted(args.onPhase, now, uploadStartedAt, "upload", false, "local-tree archive upload failed");
-        throw new Error(`subject-upload failed: ${tailOf(args.scrub(toErrorMessage(error)))}`);
-    }
-    emitPhaseCompleted(args.onPhase, now, uploadStartedAt, "upload", true, "local-tree archive uploaded");
-    const extractCommand = `rm -rf ${SUBJECT_DIR} && mkdir -p ${SUBJECT_DIR} && tar -xzf ${LOCAL_TREE_REMOTE_ARCHIVE_PATH} -C ${SUBJECT_DIR} && rm -f ${LOCAL_TREE_REMOTE_ARCHIVE_PATH}`;
-    const extractStartedAt = now();
-    emitPhaseStarted(args.onPhase, now, "extract", "extracting local-tree archive");
-    const extract = await runDetachedStep(desktop, {
-        name: "subject-extract",
-        command: extractCommand,
-        timeoutMs: CLONE_TIMEOUT_MS,
-        requestTimeoutMs: args.requestTimeoutMs,
-        ...timers
-    });
-    emitPhaseCompleted(args.onPhase, now, extractStartedAt, "extract", extract.ok, extract.ok ? "local-tree archive extracted" : "local-tree archive extraction failed");
-    if (!extract.ok) {
-        throw new Error(`subject extract ${extract.timedOut ? "timed out" : `failed (exit ${extract.exitCode})`}: ${tailOf(args.scrub(extract.logTail))}`);
-    }
-    await runSubjectServePipeline(desktop, {
-        serve: args.serve,
-        ...(args.state === undefined ? {} : { state: args.state }),
-        requestTimeoutMs: args.requestTimeoutMs,
-        scrub: args.scrub,
-        ...(args.onStateStep === undefined ? {} : { onStateStep: args.onStateStep }),
-        ...(args.onPhase === undefined ? {} : { onPhase: args.onPhase }),
-        ...timers
-    });
-}
 /**
  * Default local-tree packing implementation: createLocalTreeArchive(root, opts) on the host,
  * then a single read of the produced archive file into an ArrayBuffer for upload. The DI seam
@@ -4076,10 +2280,6 @@ export async function defaultPackLocalTree(args) {
     await rm(path.dirname(archive.archivePath), { recursive: true, force: true }).catch(() => undefined);
     return { archive, buffer };
 }
-/** sha256 hex of the exact command string, first 16 chars (the promptDigest convention). */
-export function commandDigestOf(command) {
-    return digestText(command, 16);
-}
 /**
  * Resolve the bundle's state marker from the declaration and what actually ran.
  * Precedence: external declared → "unpinned" (seed records, if any, stay attached — a
@@ -4135,10 +2335,6 @@ function describeSubjectState(state, dryRun) {
             return "external-public (operator-declared, operator-owned public deployment; neither provisioned nor seeded)";
     }
 }
-// The in-sandbox `tail -c` upstream is a fundamental log-tail limit we cannot redact past.
-function tailOf(log) {
-    return redactedTail(log, ERROR_TAIL_CHARS);
-}
 export function buildCuaCostSummary(args) {
     const breakdown = [];
     let sumInput = 0;