humanish 0.97.0 → 0.98.0

package/dist/computer-use.js

@@ -1,9 +1,12 @@
 import { ACTOR_TRACE_SCHEMA } from "./actor-contract.js";
+import { CuaProviderError, isCuaProviderError } from "./cua-provider-error.js";
 import { classifyCuaAction, summarizeAffordanceUse } from "./affordance.js";
 import { commandFailureInfo, isCommandExitError } from "./command-failure.js";
 import { evaluateStopWhen } from "./stop-conditions.js";
 import { TaskTracker } from "./tasks.js";
 import { isCuaAdmissionLimitError } from "./cua-admission-limit.js";
+import { CuaExecutorError, isCuaExecutorError } from "./cua-executor-error.js";
+export const CUA_PROVIDER_CLEANUP_GRACE_MS = 5000;
 /** Runtime validation is also required for third-party provider ports. */
 export function validClosingReport(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
@@ -329,6 +332,11 @@ function raceSettle(promise, remainingMs, signal) {
  * before its ref is recorded, so the trace is public-safe by construction.
  */
 export async function runComputerUseLoop(options) {
+    if (options.provider.executionProfile?.billing === "account-unknown" &&
+        (options.maxUsd !== undefined || options.overRunBudget !== undefined || options.estimateTurnCostUsd !== undefined ||
+            options.provider.modelSettings?.maxOutputTokens !== undefined)) {
+        throw new CuaProviderError("request_rejected", { dispatched: false, usageComplete: false, cleanup: "confirmed" });
+    }
     const { instructions, provider, executor, persona, redaction, timeoutMs, now, signal, idleSteps = DEFAULT_IDLE_STEPS, noProgressSteps = DEFAULT_NO_PROGRESS_STEPS, acknowledgeSafetyChecks = () => null, redactScreenshots = false, scrubText = (text) => text, writeScreenshot = async (name) => `screenshots/${name}`, stopWhen, dwell, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), tasks, maxUsd, overRunBudget, estimateTurnCostUsd, requireReportedUsageForSpendCap = false, onObservedUrl, onMessage, onScreenshot, onTrace } = options;
     const noProgressRecoverySteps = Math.min(Math.max(1, noProgressSteps - 1), 3);
     const idleRecoverySteps = Math.min(Math.max(1, idleSteps - 1), 3);
@@ -341,6 +349,14 @@ export async function runComputerUseLoop(options) {
     const turnTimeoutMs = options.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
     const observationTimeoutMs = options.observationTimeoutMs ?? DEFAULT_OBSERVATION_TIMEOUT_MS;
     const items = [];
+    const providerRequests = [];
+    let providerCleanupUnconfirmed = false;
+    const liveMetadata = () => ({
+        ...(provider.executionProfile === undefined ? {} : { executionProfile: provider.executionProfile }),
+        ...(provider.requestPolicy === "fail_closed" ? { providerRequests: providerRequests.map(row => ({ ...row })),
+            historyTurnsOmitted: provider.historyTurnsOmitted ?? 0 } : {})
+    });
+    const flushTrace = () => onTrace?.(items.slice(), runningUsage(), liveMetadata());
     // The ONE recording choke point (#441): every trace item is stamped `at` from the
     // loop's injected clock as it is recorded, so timed playback reads recorded facts
     // (deterministic in tests via the injected `now`).
@@ -368,6 +384,7 @@ export async function runComputerUseLoop(options) {
     // zero material actions is still an honest failure (timed_out). Kept beside counts.materialActions
     // so the evidence self-describes the distinction.
     let materialActions = 0;
+    let interruptedActionOutcome = false;
     let seq = 0;
     let usageInput = 0;
     let usageCachedInput = 0;
@@ -382,7 +399,16 @@ export async function runComputerUseLoop(options) {
     // was always a number (0 included), and arithmetic on a suddenly-undefined field yields NaN —
     // which comparison operators swallow silently (red-team finding: a stale study-budget guard
     // would run uncapped without a sound).
-    const runningUsage = () => ({
+    const accountUsage = () => ({
+        ...(usageTurns.some(t => t.input !== undefined) ? { input: usageInput } : {}),
+        ...(usageTurns.some(t => t.output !== undefined) ? { output: usageOutput } : {}),
+        ...(usageTurns.some(t => t.cachedInput !== undefined) ? { cachedInput: usageCachedInput } : {}),
+        ...(usageTurns.some(t => t.cacheWriteInput !== undefined) ? { cacheWriteInput: usageCacheWriteInput } : {}),
+        ...(usageTurns.length > 0 ? { turns: usageTurns.map(t => ({ ...t })) } : {}),
+        ...(providerRequests.length > 0 && providerRequests.every(r => r.usageComplete && completeTurnUsage(r.usage))
+            ? { total: usageInput + usageOutput } : {})
+    });
+    const runningUsage = () => provider.executionProfile?.billing === "account-unknown" ? accountUsage() : ({
         input: usageInput,
         output: usageOutput,
         cachedInput: usageCachedInput,
@@ -405,7 +431,7 @@ export async function runComputerUseLoop(options) {
         counts[key] = (counts[key] ?? 0) + 1;
     };
     const recordUsage = (turn, interaction = true) => {
-        if (interaction && !completeTurnUsage(turn.usage))
+        if (interaction && (!completeTurnUsage(turn.usage) || turn.providerRequest?.usageComplete === false))
             incompleteInteractionUsage = true;
         const raw = turn.usage;
         if (raw === undefined)
@@ -425,6 +451,85 @@ export async function runComputerUseLoop(options) {
         usageOutput += usage.output ?? 0;
         usageTurns.push(usage);
     };
+    /** Marked providers own one attempt through settlement; an outer race never retries it. */
+    const markedRequest = async (request, kind, capMs) => {
+        const controller = new AbortController();
+        const onAbort = () => controller.abort();
+        if (signal?.aborted)
+            controller.abort();
+        else
+            signal?.addEventListener("abort", onAbort, { once: true });
+        let settlement;
+        let failure;
+        let failed = false;
+        let accepted;
+        const pending = Promise.resolve().then(() => {
+            if (controller.signal.aborted)
+                throw new CuaProviderError("cancelled", { dispatched: false, usageComplete: false, cleanup: "confirmed" });
+            return kind === "debrief" ? provider.debrief(request, controller.signal) : provider.nextTurn(request, controller.signal);
+        }).then(turn => { settlement = { turn }; return turn; }, (error) => { settlement = { error }; throw error; });
+        void pending.catch(() => undefined);
+        try {
+            accepted = await raceBounded(`participant ${kind}`, pending, remaining(), capMs, signal);
+            const r = accepted.providerRequest;
+            if (!r || r.dispatched !== true || typeof r.usageComplete !== "boolean" || r.cleanup !== "confirmed") {
+                throw new CuaProviderError("invalid_response", { dispatched: "unknown", usageComplete: false, cleanup: "unconfirmed" }, accepted.usage);
+            }
+        }
+        catch (error) {
+            failed = true;
+            failure = error;
+        }
+        finally {
+            controller.abort();
+            signal?.removeEventListener("abort", onAbort);
+            if (settlement === undefined) {
+                let timer;
+                try {
+                    await Promise.race([pending.catch(() => undefined), new Promise(resolve => {
+                            timer = setTimeout(resolve, CUA_PROVIDER_CLEANUP_GRACE_MS);
+                        })]);
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+            }
+        }
+        const final = settlement;
+        const typed = isCuaProviderError(failure) ? failure : final && "error" in final && isCuaProviderError(final.error) ? final.error : undefined;
+        const turn = final && "turn" in final ? final.turn : undefined;
+        const raw = typed?.receipt ?? turn?.providerRequest;
+        const receipt = raw && (typeof raw.dispatched === "boolean" || raw.dispatched === "unknown") &&
+            typeof raw.usageComplete === "boolean" && ["confirmed", "unconfirmed"].includes(raw.cleanup) ? { dispatched: raw.dispatched, usageComplete: raw.usageComplete, cleanup: raw.cleanup }
+            : { dispatched: "unknown", usageComplete: false, cleanup: "unconfirmed" };
+        const rawUsage = typed?.usage ?? turn?.usage;
+        const usage = rawUsage === undefined ? undefined : Object.fromEntries(["input", "output", "cachedInput", "cacheWriteInput", "total"].flatMap(key => {
+            const value = rawUsage[key];
+            return validTokenCount(value) ? [[key, value]] : [];
+        }));
+        // restricted-codex-session sets dispatched only after initialize/config/account/
+        // thread/MCP admission, immediately before turn/start; it is not a success claim.
+        providerRequests.push({ ordinal: providerRequests.length + 1, kind, ...receipt,
+            profileVerified: provider.executionProfile !== undefined && receipt.dispatched === true,
+            ...(typed ? { errorCode: typed.code } : {}), ...(usage === undefined ? {} : { usage: { ...usage } }) });
+        if (receipt.cleanup !== "confirmed") {
+            providerCleanupUnconfirmed = true;
+            record({ id: nextId("notice"), kind: "notice", lifecycle: "completed", status: "error",
+                title: "participant request cleanup unconfirmed", text: "The request did not confirm cleanup within the settlement boundary. No further participant request or action is admitted." });
+        }
+        if (kind === "interaction" && receipt.dispatched !== false && (!receipt.usageComplete || !completeTurnUsage(usage)))
+            unreportedInteractionUsage = true;
+        if (failed) {
+            if (usage)
+                recordUsage({ actions: [], pendingSafetyChecks: [], done: false, usage, providerRequest: receipt }, kind === "interaction");
+            if (failure instanceof CuaAbortError || failure instanceof CuaDeadlineError)
+                throw failure;
+            if (failure instanceof CuaStallError)
+                throw new CuaProviderError("timeout", receipt, usage);
+            throw typed ?? new CuaProviderError("process_failed", receipt, usage);
+        }
+        return accepted;
+    };
     // Whether any observation this run surfaced structured appState (a non-vision/state executor).
     // RUNTIME-ONLY signal: used solely to self-describe in redaction.notes that app state drove
     // progress detection and was NOT written to the trace — the appState itself never persists.
@@ -517,6 +622,7 @@ export async function runComputerUseLoop(options) {
     // Loop-local state. Declared here (before the try) so the initial observe + the per-turn
     // frame guard can fail closed cleanly while these still scope across the loop.
     let previousResponseId;
+    let previousExecution;
     let closingObservation;
     let closingTrigger;
     let debrief;
@@ -535,8 +641,8 @@ export async function runComputerUseLoop(options) {
     let pendingAcks;
     try {
         currentPhase = "observing initial UI state";
-        // A stalled observe is retried once (#480); a second stall is the substrate telling us it is
-        // gone, and that ends the lane with its own name rather than an unexplained deadline.
+        // Legacy executors retry a stalled observe once (#480). A transport that cannot safely
+        // replay pending requests opts out, so even a shorter outer bound stops without retrying.
         const observeBounded = async (label) => {
             try {
                 return await raceBounded(`observe (${label})`, executor.observe(), remaining(), observationTimeoutMs, signal);
@@ -544,6 +650,11 @@ export async function runComputerUseLoop(options) {
             catch (error) {
                 if (!(error instanceof CuaStallError))
                     throw error;
+                if (executor.stallRecovery === "fail_closed") {
+                    // The outer bound says nothing about whether the still-pending request completed.
+                    // The owning session will close it; this loop must not send a replacement request.
+                    throw new CuaExecutorError("deadline_exceeded", "outcome_uncertain");
+                }
                 record({
                     id: nextId("notice"),
                     kind: "notice",
@@ -598,7 +709,7 @@ export async function runComputerUseLoop(options) {
                 if (frameObservation.screenshot !== undefined)
                     onScreenshot?.(frameObservation.screenshot);
                 await maybeRecordScreenshot(frameObservation, `dwell-${frames.toString().padStart(2, "0")}`);
-                onTrace?.(items.slice(), runningUsage());
+                flushTrace();
                 observeTasks(frameObservation, turnNumber);
             }
             dwellHeldMs = now() - dwellStartedAtMs;
@@ -628,7 +739,7 @@ export async function runComputerUseLoop(options) {
         if (frameGuardTripped(observation))
             throw new CuaFrameGuardStop();
         await maybeRecordScreenshot(observation, "turn-00-start");
-        onTrace?.(items.slice(), runningUsage());
+        flushTrace();
         observeTasks(observation, 0);
         const initialDwell = await dwellIfDue(observation, 0);
         if (initialDwell !== undefined) {
@@ -680,7 +791,7 @@ export async function runComputerUseLoop(options) {
                 break;
             }
             const turnNumber = (counts.turns ?? 0) + 1;
-            const request = { instructions, observation };
+            const request = { instructions, observation, ...(provider.requestPolicy !== "fail_closed" || previousExecution === undefined ? {} : { previousExecution }) };
             if (previousResponseId !== undefined)
                 request.previousResponseId = previousResponseId;
             if (contextHint !== undefined)
@@ -696,68 +807,73 @@ export async function runComputerUseLoop(options) {
             let turn;
             // A timeout race alone does not cancel its losing provider promise. Strict accounting
             // owns this signal so a delayed transport failure cannot retry after the loop has ended.
-            const requestController = requiresUsage ? new AbortController() : undefined;
-            const onRequestAbort = () => requestController?.abort();
-            if (requestController) {
-                if (signal?.aborted)
-                    requestController.abort();
-                else
-                    signal?.addEventListener("abort", onRequestAbort, { once: true });
+            if (provider.requestPolicy === "fail_closed") {
+                turn = await markedRequest(request, "interaction", turnTimeoutMs);
             }
-            const requestSignal = requestController?.signal ?? signal ?? neverAbort;
-            try {
-                turn = await raceBounded(`provider turn ${turnNumber}`, provider.nextTurn(request, requestSignal), remaining(), turnTimeoutMs, signal);
-            }
-            catch (error) {
-                if (isCuaAdmissionLimitError(error)) {
-                    stopForAdmissionLimit();
-                    break;
-                }
-                // A thrown request may have been billed without returning usage. Admission refusal is
-                // the explicit no-dispatch exception above; strict capped routes cannot safely retry.
-                if (requiresUsage) {
-                    stopForUnreportedUsage();
-                    break;
+            else {
+                const requestController = requiresUsage ? new AbortController() : undefined;
+                const onRequestAbort = () => requestController?.abort();
+                if (requestController) {
+                    if (signal?.aborted)
+                        requestController.abort();
+                    else
+                        signal?.addEventListener("abort", onRequestAbort, { once: true });
                 }
-                if (!(error instanceof CuaStallError))
-                    throw error;
-                unreportedInteractionUsage = true;
-                record({
-                    id: nextId("notice"),
-                    kind: "notice",
-                    lifecycle: "completed",
-                    status: "warn",
-                    title: "provider turn stalled; retrying once",
-                    text: `${error.what} produced nothing within ${error.afterMs}ms; sending the same observation again`
-                });
+                const requestSignal = requestController?.signal ?? signal ?? neverAbort;
                 try {
-                    turn = await raceBounded(`provider turn ${turnNumber} (retry)`, provider.nextTurn(request, signal ?? neverAbort), remaining(), turnTimeoutMs, signal);
+                    turn = await raceBounded(`provider turn ${turnNumber}`, provider.nextTurn(request, requestSignal), remaining(), turnTimeoutMs, signal);
                 }
-                catch (retryError) {
-                    if (isCuaAdmissionLimitError(retryError)) {
+                catch (error) {
+                    if (isCuaAdmissionLimitError(error)) {
                         stopForAdmissionLimit();
                         break;
                     }
-                    if (!(retryError instanceof CuaStallError))
-                        throw retryError;
+                    // A thrown request may have been billed without returning usage. Admission refusal is
+                    // the explicit no-dispatch exception above; strict capped routes cannot safely retry.
+                    if (requiresUsage) {
+                        stopForUnreportedUsage();
+                        break;
+                    }
+                    if (!(error instanceof CuaStallError))
+                        throw error;
                     unreportedInteractionUsage = true;
-                    completionReason = "harness_error";
-                    reason = `provider turn ${turnNumber} stalled twice (${retryError.afterMs}ms each); the model produced no turn and the lane was ended rather than left to run out its budget`;
                     record({
                         id: nextId("notice"),
                         kind: "notice",
                         lifecycle: "completed",
-                        status: "error",
-                        title: "provider turn stalled twice",
-                        text: reason
+                        status: "warn",
+                        title: "provider turn stalled; retrying once",
+                        text: `${error.what} produced nothing within ${error.afterMs}ms; sending the same observation again`
                     });
-                    break;
+                    try {
+                        turn = await raceBounded(`provider turn ${turnNumber} (retry)`, provider.nextTurn(request, signal ?? neverAbort), remaining(), turnTimeoutMs, signal);
+                    }
+                    catch (retryError) {
+                        if (isCuaAdmissionLimitError(retryError)) {
+                            stopForAdmissionLimit();
+                            break;
+                        }
+                        if (!(retryError instanceof CuaStallError))
+                            throw retryError;
+                        unreportedInteractionUsage = true;
+                        completionReason = "harness_error";
+                        reason = `provider turn ${turnNumber} stalled twice (${retryError.afterMs}ms each); the model produced no turn and the lane was ended rather than left to run out its budget`;
+                        record({
+                            id: nextId("notice"),
+                            kind: "notice",
+                            lifecycle: "completed",
+                            status: "error",
+                            title: "provider turn stalled twice",
+                            text: reason
+                        });
+                        break;
+                    }
+                }
+                finally {
+                    if (requestController)
+                        signal?.removeEventListener("abort", onRequestAbort);
+                    requestController?.abort();
                 }
-            }
-            finally {
-                if (requestController)
-                    signal?.removeEventListener("abort", onRequestAbort);
-                requestController?.abort();
             }
             bump("turns");
             previousResponseId = turn.responseId ?? previousResponseId;
@@ -906,21 +1022,27 @@ export async function runComputerUseLoop(options) {
                 // FINAL state — and a task completed by that state read as incomplete. The first live
                 // study caught it: both participants reached the dashboard, said so, and the funnel
                 // reported 0/2. One guarded closing observation feeds the tracker; a failed observe
-                // changes nothing (the funnel stays honest about what it saw), and no screenshot or
-                // stop evaluation rides it — the session is already over.
+                // ordinarily changes nothing (the funnel stays honest about what it saw), and no
+                // screenshot or stop evaluation rides it — the session is already over. An explicit
+                // executor failure still fails the harness instead of disappearing behind completion.
                 if (taskTracker !== undefined) {
                     try {
+                        currentPhase = "observing closing task state";
                         const closing = await observeBounded("closing");
                         observeTasks(closing, turnNumber);
                     }
-                    catch {
-                        // Best-effort by design.
+                    catch (error) {
+                        // Ordinary closing observations remain best-effort. A declared executor failure
+                        // must not disappear behind a participant's reported success.
+                        if (isCuaExecutorError(error))
+                            throw error;
                     }
                 }
                 break;
             }
             const idleThisTurn = isIdleTurn(turn.actions);
-            for (const action of turn.actions) {
+            previousExecution = { actions: [] };
+            for (const [actionIndex, action] of turn.actions.entries()) {
                 if (signal?.aborted)
                     throw new CuaAbortError();
                 const actionTitle = describeCuaAction(action);
@@ -959,6 +1081,22 @@ export async function runComputerUseLoop(options) {
                         else
                             await raceBounded(`idle action ${actionTitle}`, pending, remaining(), idleBound, signal);
                     }
+                    catch (error) {
+                        if (error instanceof CuaStallError && executor.stallRecovery === "fail_closed") {
+                            throw new CuaExecutorError("deadline_exceeded", "outcome_uncertain");
+                        }
+                        if (error instanceof CuaDeadlineError || error instanceof CuaAbortError) {
+                            // The loop's deadline/abort may win before the executor can report whether its
+                            // write reached the desktop. Cancellation alone does not establish rollback.
+                            interruptedActionOutcome = true;
+                            record({
+                                id: nextId("notice"), kind: "notice", lifecycle: "completed", status: "warn",
+                                title: "action outcome uncertain",
+                                text: redactNarration(`action: ${actionTitle}; disposition: outcome_uncertain; the loop stopped waiting before execution was acknowledged; the action was not retried`)
+                            });
+                        }
+                        throw error;
+                    }
                     finally {
                         signal?.removeEventListener("abort", onAbort);
                         // A deadline also closes async executor preparation, so a late pointer read
@@ -966,6 +1104,7 @@ export async function runComputerUseLoop(options) {
                         actionController.abort();
                     }
                 };
+                let actionSkipped = false;
                 try {
                     if (isIdleAction(action)) {
                         // Observation actions only look (#480). A `wait` that hangs inside the SDK has, by
@@ -977,6 +1116,7 @@ export async function runComputerUseLoop(options) {
                         catch (error) {
                             if (!(error instanceof CuaStallError))
                                 throw error;
+                            actionSkipped = true;
                             record({
                                 id: nextId("notice"),
                                 kind: "notice",
@@ -998,8 +1138,17 @@ export async function runComputerUseLoop(options) {
                     // (e.g. a Ctrl+Minus keypress exiting 2), so one flaky desktop command
                     // must not end the whole run. Everything else — a raceSettle deadline
                     // (CuaDeadlineError) or abort (CuaAbortError), a sandbox-gone failure,
-                    // any non-CommandExitError — is RE-THROWN so the existing fatal handling
-                    // (actor_error / timed_out / harness_error) stays byte-identical.
+                    // any non-CommandExitError — is rethrown. A typed executor declaration must also
+                    // bypass command recovery even if an adapter has changed its ordinary Error metadata.
+                    if (isCuaExecutorError(error)) {
+                        previousExecution.actions.push({ index: actionIndex, status: error.disposition });
+                        if (error.disposition === "not_dispatched" && !isIdleAction(action)) {
+                            materialActions -= 1;
+                            counts.materialActions = materialActions;
+                            lastMaterialActionTitle = priorMaterialActionTitle;
+                        }
+                        throw error;
+                    }
                     if (!isCommandExitError(error))
                         throw error;
                     if (!isIdleAction(action)) {
@@ -1017,6 +1166,7 @@ export async function runComputerUseLoop(options) {
                         // counts.materialActions is 0 (honest-evidence invariant).
                         lastMaterialActionTitle = priorMaterialActionTitle;
                     }
+                    previousExecution.actions.push({ index: actionIndex, status: "skipped" });
                     const { exitCode, stderrTail } = commandFailureInfo(error);
                     record({
                         id: nextId("notice"),
@@ -1036,6 +1186,7 @@ export async function runComputerUseLoop(options) {
                     });
                     continue;
                 }
+                previousExecution.actions.push({ index: actionIndex, status: actionSkipped ? "skipped" : "completed" });
                 record({
                     id: nextId("ui_action"),
                     kind: "ui_action",
@@ -1062,7 +1213,7 @@ export async function runComputerUseLoop(options) {
             if (frameGuardTripped(observation))
                 break;
             await maybeRecordScreenshot(observation, `turn-${turnNumber.toString().padStart(2, "0")}`);
-            onTrace?.(items.slice(), runningUsage());
+            flushTrace();
             observeTasks(observation, turnNumber);
             const dwellOutcome = await dwellIfDue(observation, turnNumber);
             if (dwellOutcome !== undefined) {
@@ -1189,7 +1340,9 @@ export async function runComputerUseLoop(options) {
             stopCause = "time_limit";
             if (materialActions > 0) {
                 completionReason = "budget_reached";
-                reason = `reached the ${timeoutMs}ms time budget after productive activity (${materialActions} material action(s), ${counts.turns} turn(s))`;
+                reason = interruptedActionOutcome
+                    ? `reached the ${timeoutMs}ms time budget with ${materialActions} material action attempt(s), ${counts.turns} turn(s); the latest action outcome is uncertain`
+                    : `reached the ${timeoutMs}ms time budget after productive activity (${materialActions} material action(s), ${counts.turns} turn(s))`;
             }
             else {
                 completionReason = "timed_out";
@@ -1201,6 +1354,27 @@ export async function runComputerUseLoop(options) {
             reason = "run aborted by the harness";
             stopCause = "harness_aborted";
         }
+        else if (isCuaProviderError(error)) {
+            completionReason = "harness_error";
+            reason = `participant provider error: ${error.code}; cleanup: ${error.receipt.cleanup}`;
+            record({ id: nextId("notice"), kind: "notice", lifecycle: "completed", status: "error",
+                title: "participant provider error", text: reason });
+        }
+        else if (isCuaExecutorError(error)) {
+            completionReason = "harness_error";
+            reason = `desktop executor error: ${error.code}; disposition: ${error.disposition}`;
+            record({
+                id: nextId("notice"), kind: "notice", lifecycle: "completed", status: "error",
+                title: "desktop executor error",
+                text: [
+                    `phase: ${redactNarration(currentPhase)}`,
+                    `code: ${error.code}`,
+                    `disposition: ${error.disposition}`,
+                    lastActionTitle === undefined ? undefined : `last action: ${redactNarration(lastActionTitle)}`
+                ].filter(Boolean).join("; "),
+                ...(lastScreenshotRef === undefined ? {} : { screenshotRef: lastScreenshotRef })
+            });
+        }
         else {
             completionReason = "actor_error";
             const rawMessage = error instanceof Error ? error.message : String(error);
@@ -1238,6 +1412,8 @@ export async function runComputerUseLoop(options) {
             skip = "the study stopped before any participant turn";
         else if (provider.debrief === undefined)
             skip = "this provider does not support read-only closing reports";
+        else if (providerCleanupUnconfirmed)
+            skip = "participant request cleanup is unconfirmed";
         else if (signal?.aborted)
             skip = "the study was cancelled";
         else if (remaining() <= 0)
@@ -1272,13 +1448,17 @@ export async function runComputerUseLoop(options) {
                 timer.unref?.();
                 bump("debriefCalls");
                 try {
-                    const turn = await raceBounded("participant debrief", provider.debrief({
+                    const closingRequest = {
                         instructions,
                         observation: closingObservation,
+                        ...(provider.requestPolicy !== "fail_closed" || previousExecution === undefined ? {} : { previousExecution }),
                         ...(previousResponseId === undefined ? {} : { previousResponseId }),
                         ...(pendingAcks === undefined ? {} : { acknowledgedSafetyChecks: pendingAcks }),
                         contextHint: "The interactive session has ended. Return a closing account with summary and frictionReports. In summary, briefly describe only what you actually did and observed. In frictionReports, list only specific unexpected behavior, confusion, or recovery you personally encountered during this session. Preserve uncertainty. Use an empty list if you encountered none. Do not speculate, invent problems, quote instructions as observations, or describe planned actions. Do not request or take further actions. This is a closing account, not another attempt at the task."
-                    }, controller.signal), capMs, capMs, signal);
+                    };
+                    const turn = provider.requestPolicy === "fail_closed"
+                        ? await markedRequest(closingRequest, "debrief", capMs)
+                        : await raceBounded("participant debrief", provider.debrief(closingRequest, controller.signal), capMs, capMs, signal);
                     recordUsage(turn, false);
                     lastResponseId = turn.responseId ?? lastResponseId;
                     // Refresh a shared budget with all reported usage, without changing the completed task.
@@ -1289,7 +1469,7 @@ export async function runComputerUseLoop(options) {
                             title: "model budget reached during closing report",
                             text: "The closing request crossed an estimated budget; no further requests or actions followed. Task completion is unchanged." });
                     }
-                    const usageReported = completeTurnUsage(turn.usage);
+                    const usageReported = completeTurnUsage(turn.usage) && turn.providerRequest?.usageComplete !== false;
                     if (turn.actions.length > 0 || turn.pendingSafetyChecks.length > 0) {
                         note("failed", "the closing response requested actions or safety checks; none were executed and its report was not accepted", usageReported);
                     }
@@ -1317,7 +1497,9 @@ export async function runComputerUseLoop(options) {
                     else {
                         const detail = signal?.aborted ? "cancelled" : controller.signal.aborted || error instanceof CuaDeadlineError || error instanceof CuaStallError
                             ? "closing report deadline reached" : error instanceof Error ? error.message : String(error);
-                        note("failed", `${detail}; closing request usage is unreported`, false);
+                        const closingReceipt = provider.requestPolicy === "fail_closed" ? providerRequests.at(-1) : undefined;
+                        const usageReported = closingReceipt?.kind === "debrief" && closingReceipt.usageComplete && completeTurnUsage(closingReceipt.usage);
+                        note("failed", `${detail}; closing request usage is ${usageReported ? "reported" : "unreported"}`, usageReported);
                     }
                 }
                 finally {
@@ -1327,7 +1509,7 @@ export async function runComputerUseLoop(options) {
                 }
             }
         }
-        onTrace?.(items.slice(), runningUsage());
+        flushTrace();
     }
     const completedAtMs = now();
     const status = statusForCompletionReason(completionReason);
@@ -1352,6 +1534,7 @@ export async function runComputerUseLoop(options) {
     const trace = {
         schema: ACTOR_TRACE_SCHEMA,
         provider: provider.id,
+        ...liveMetadata(),
         ...(provider.version === undefined ? {} : { providerVersion: provider.version }),
         protocol: "cua-loop",
         lane: "computer-use",
@@ -1388,7 +1571,7 @@ export async function runComputerUseLoop(options) {
         ...(taskTracker === undefined ? {} : { taskFunnel: taskTracker.funnel() }),
         ...(sawUsage
             ? {
-                tokenUsage: {
+                tokenUsage: provider.executionProfile?.billing === "account-unknown" ? accountUsage() : {
                     input: usageInput,
                     output: usageOutput,
                     // Recorded only when the provider actually reported it, so a reader can tell "no cache