humanish 0.99.0 → 0.100.0

package/docs/architecture/browser-control.md

@@ -34,6 +34,12 @@ calls are rejected rather than queued. The client marks its executor with
 `stallRecovery: 'fail_closed'`, so an earlier computer-use loop deadline cannot
 trigger the legacy observation retry or idle-action skip behavior.
 
+An action explicitly rejected with `action_rejected` / `not_dispatched` can
+recover in the shared study loop. It records the rejection, withholds the rest
+of that action batch and takes a fresh observation before asking the participant
+what to do next. It never automatically replays input. Other executor failures,
+including uncertain outcomes and failed observations, still end the session.
+
 ## Wire contract
 
 Each frame is a four-byte unsigned big-endian length followed by strict UTF-8

package/docs/architecture/local-browser-runtime.md

@@ -18,8 +18,22 @@ and account restrictions. Docker access is an administrative capability.
 Humanish does not install Docker on Linux or change host permissions. On Mac,
 setup installs Docker only inside the dedicated Lima host.
 
-Start your app on loopback, then save a lab such as
-`.humanish/labs/local-browser.yaml`:
+Configure the starter while initializing the project, then start your app on
+the same loopback URL:
+
+```sh
+npx humanish init --yes \
+  --local-browser http://127.0.0.1:3000 \
+  --local-mission "Create a note and explain anything confusing about saving it"
+npx humanish doctor --lab local-browser
+npx humanish lab run local-browser
+```
+
+`init` also writes `humanish/labs/local-browser.yaml` with safe defaults when
+the two options are omitted. The options provide the normal setup path for the
+app URL and mission on first setup. If the file already exists, `init` preserves
+it and warns that these options were skipped; edit the existing manifest to
+change its URL or mission. The resulting lab has this shape:
 
 ```yaml
 schema: humanish.lab.v2
@@ -42,10 +56,9 @@ execution:
 ```
 
 ```sh
-npx humanish init --yes
 npx humanish runtime status --json
-npx humanish doctor --lab .humanish/labs/local-browser.yaml --json
-npx humanish lab run .humanish/labs/local-browser.yaml
+npx humanish doctor --lab local-browser --json
+npx humanish lab run local-browser
 ```
 
 The first live run downloads the pinned runtime archive (about 569 MiB on x64 or
@@ -68,6 +81,13 @@ For API billing and its supported caps, use `type: openai-computer-use`, remove
 default. Neither path silently falls back to another provider or hosted desktop.
 Existing labs without `execution.target: local` retain their previous behavior.
 
+Before handing the desktop to the participant, the guest navigates to the
+selected app and waits up to 30 seconds for the initial document's
+`DOMContentLoaded` event, then allows a bounded paint. It does not wait for app
+data, images or network idle: the app's own loading screen remains observable.
+Navigation failures and timeouts fail startup and release the owned desktop.
+Later participant actions and observations do not use this startup wait.
+
 ## Current limits
 
 - Linux x64 or M3-or-newer Mac with native ARM64 Node and Lima. The installed

package/docs/contracts/schemas.md

@@ -3,7 +3,7 @@
 Date: 2026-06-02 (current-state note updated 2026-07-14)
 
 Status: reference map for the major contracts shipped through source version
-`0.99.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
+`0.100.0`; it is not an exhaustive inventory of command/result envelopes. Exported types,
 schema constants, parsers, and validators in `src/` are authoritative. Rows
 marked "reserved" name layering intent only — no code emits or validates them
 yet. Do not emit a reserved schema.
@@ -768,6 +768,13 @@ scenario:
 
 ## Actor Trace
 
+Failed account participant requests may include an optional `failurePhase` in
+`providerRequests`, identifying startup, the named Codex setup RPC, `turn/start`,
+`response`, or cleanup. It is a finite local classification, never raw provider
+text. Older receipts without it remain valid. The phase does not replace the
+separate dispatch, usage, or cleanup evidence, and does not establish the cause
+of a timeout. Participant outcome text includes the phase when available.
+
 Actors execute or simulate the trial. Actor evidence is the provider-neutral
 `humanish.actor-trace.v1` (`src/actor-contract.ts`): Codex app-server items,
 Claude Agent SDK blocks, pi events, computer-use cycles, scripted browser

package/docs/goals/current.md

@@ -1,9 +1,9 @@
 # Current Goals
 
-Status date: 2026-09-24. Release baseline: `0.99.0`.
+Status date: 2026-09-25. Release baseline: `0.100.0`.
 
 This page guides work on current merged source. Published behavior is described
-in the [release notes](../release/0.99.0-local-browser-mac.md).
+in the [release notes](../release/0.100.0-local-setup.md).
 The [September 9 history](https://github.com/danielgwilson/humanish/blob/main/docs/goals/current-history-2026-09-09.md)
 preserves the former status log; its queues do not supersede this page.
 
@@ -88,7 +88,7 @@ requires decision-equivalent retained evidence and a real deletion branch.
 No first-party deletion branch has met that gate. Public demonstrations do not
 substitute for it.
 
-## Current Program Truth (source `0.99.0`)
+## Current Program Truth (source `0.100.0`)
 
 | Surface | Available in merged source | Remaining boundary |
 | --- | --- | --- |
@@ -123,8 +123,8 @@ ordinary TAP/NAT networking. Continue managed-local work from this complete stud
 path; the earlier offline owner/service qualification experiments are historical
 fixtures, not an installation architecture or a prerequisite queue. Explicit
 Linux local labs now use the installed CLI/TUI, with a verified runtime download
-before the first live run. Mac support, inbox integration and optional media
-remain unfinished. Existing hosted labs retain their behavior.
+before the first live run. Mac support is also shipped; inbox integration and
+optional media remain unfinished. Existing hosted labs retain their behavior.
 
 ## Gates And Deferred Work
 

package/docs/ramp/README.md

@@ -2,7 +2,7 @@
 
 Status: public-safe contributor and agent ramp.
 
-Package/source version in this tree: `0.99.0` (2026-09-24). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
+Package/source version in this tree: `0.100.0` (2026-09-25). The Observer is phone-usable as a stated requirement (observer/AGENTS.md); interactive primitives start from Base UI. The Observer renderer is the observer/ workspace artifact only; the legacy string-concat renderer was deleted at cutover (#426), and rollback is a version pin to 0.42.0. The containment boundary introduced in
 `0.15.1` remains in force: managed run and output paths bind to validated
 physical filesystem identities, and stored provider IDs are evidence, not
 cleanup authority. The bundled OSS meta-lab is dry-run only until
@@ -54,6 +54,12 @@ If a change does not improve one of those loops, it probably belongs elsewhere.
 
 ## Current State
 
+The [0.100.0 release note](../release/0.100.0-local-setup.md) describes local
+browser setup discovery, initial navigation readiness and Codex failure stages.
+
+The [0.99.1 release note](../release/0.99.1-action-recovery.md) describes
+participant recovery from browser actions rejected before dispatch.
+
 The [0.99.0 release note](../release/0.99.0-local-browser-mac.md) describes
 local browser studies on supported Apple Silicon Macs through Lima, public ARM
 runtime setup, Codex account participants and automatic analysis.

package/docs/release/0.100.0-local-setup.md

@@ -0,0 +1,31 @@
+# 0.100.0 — Local study setup and startup reliability
+
+Initialize a local browser study for your app without writing its lab manifest:
+
+```sh
+humanish init --yes --local-browser http://127.0.0.1:3000 \
+  --local-mission "Create a note and find it again"
+humanish doctor --lab local-browser
+humanish run local-browser
+```
+
+The starter uses local Firecracker browsers and the supported Codex account
+login. Model inference remains remote and consumes account quota; E2B and OpenAI
+API keys are unnecessary for this route. Linux needs local Docker/KVM/TUN;
+supported Apple Silicon Macs use Lima. Init and the TUI explain prerequisites
+and reuse the CLI's readiness checks. Existing lab files are preserved; if the
+local starter already exists, edit its URL and mission in
+`humanish/labs/local-browser.yaml` instead of rerunning the init flags.
+The free preview and hosted starter remain available. Local dry runs work without
+starting a desktop or requesting a model turn.
+
+The first local participant capture now follows the target document's
+DOMContentLoaded event and a paint. Previously a fixed 500 ms wait could expose
+the runtime's starter page. Navigation is bounded, supports redirects, and
+reports startup failures; it does not wait for all app data or subsequent loads.
+Updated x64 and ARM64 runtime images carry the initial-navigation change.
+
+Failed account participant requests retain their finite execution stage, such
+as `thread/start`, in the recording and outcome text. Older recordings remain
+readable. This adds diagnostic evidence without changing retry or deadline
+behavior; it does not claim the cause of a past timeout is known.

package/docs/release/0.99.1-action-recovery.md

@@ -0,0 +1,19 @@
+# 0.99.1 — Recover from rejected browser actions
+
+A participant can now recover when the desktop explicitly rejects an action
+before sending any input. For example, typing without an editable field focused
+previously ended a local browser study with a harness error, even though the
+browser remained usable.
+
+The shared execution loop records the rejection, withholds the remaining actions
+in that batch, and takes a fresh screenshot before asking the participant what
+to do next. This prevents a queued submit from running after rejected typing.
+The next turn receives accurate execution acknowledgements and a recovery hint;
+rejected actions are not recorded as completed input. The harness does not
+replay them automatically.
+
+Uncertain outcomes, transport failures, revoked sessions and failed observations
+retain their terminal handling. Existing time and no-progress limits still bound
+repeated rejections. Updated runtime images keep the browser-control connection
+open for this specific rejection; the shared host-side loop then allows recovery.
+Account configuration and desktop setup are unchanged.

package/docs/release/open-source-readiness.md

@@ -134,6 +134,16 @@ operations notes, local runtime caches, or private operator packets. Public
 they are synthetic, durable, and public-safe. Public image assets must remain on
 the scanner allowlist and keep their approved checksum.
 
+## Version Policy
+
+Humanish remains on `0.x` until the maintainer explicitly decides to release
+`1.0.0`. General authority to merge and publish does not imply that decision.
+Semantic-version components are integers, not decimals: the next minor after
+`0.99.0` is `0.100.0`; a patch is `0.99.1`. Use patch releases for compatible
+fixes and minor releases for features or pre-1.0 breaking changes, documenting
+any breaking changes and migration steps. Do not use `npm version major` or
+infer 1.0 readiness from a large minor number. See [SemVer](https://semver.org/).
+
 ## Publish Procedure
 
 Only after maintainer approval. Prefer the tag-gated GitHub Actions workflow

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.99.0",
+  "version": "0.100.0",
   "description": "Open-source-safe CLI for persona simulation, observer review, and public-safe feedback drafts.",
   "author": "Daniel G Wilson <daniel@danielgwilson.com>",
   "keywords": [