0.126.0: Per-participant time zones, session caps and desktop files, page paths, a lighter live Observer

humanish 0.126.0 adds per-participant settings for long, mixed studies and a lighter live Observer.
Each participant can have its own time zone (participants[].clock), which now also sets its
hosted browser, its desktop's panel clock and a desktop-cli terminal; an existing
actor.clock.timeZone sets them too. participants[].maxSessionMs lets a participant end its
session sooner and stops one still working at the cap with a closing report.
participants[].files puts files on a participant's desktop for upload dialogs, and each
computer-use turn records the page it was on (origin and path only). A closing report that opens
"REACHED THE GOAL." no longer fails its run over the page copy it paraphrases. The served Observer's
live feed sends only new items each poll: about 90 KB per poll through a synthetic 8-hour,
24-participant run, where 0.125.0 sent up to 69.5 MB. Offsets and miscased zone names are now
refused, and so is a zone on the local browser runtime.

This is a minor release because a time zone now does more and is checked more strictly:

#	0.125.0	0.126.0	What to do
1	actor.clock.timeZone set only the local time each turn tells the participant; the hosted browser and desktop ran in UTC.	It also sets the zone of each hosted participant's browser, its desktop panel's clock and a desktop-cli terminal, so pages show times in that zone. (#1657)	Nothing, unless a study relied on pages showing UTC; then remove the clock.
2	actor.clock.timeZone accepted a UTC offset (+05:00) and a name in the wrong case (europe/london).	Both are refused at parse: Chrome runs in UTC or Etc/Unknown for them. (#1657)	Write a tz database name with its capitals, such as Europe/London.
3	A time zone on the local browser runtime or through RunStudyOptions.inProcess ran with the zone in the clock hint only.	Refused before anything starts with HUMANISH_COMPUTER_USE_TIME_ZONE_UNSUPPORTED. (#1657)	Remove the clock, or run on execution.target: e2b-desktop.

Added

• participants[].clock: { timeZone } gives one participant its own zone in place of actor.clock, on computer-use and shared-world, including count: groups. The hosted browser launches with TZ set to the zone, so every tab reports it from the first page load (a CDP override held only on its own tab while attached, so humanish uses TZ); a desktop-cli terminal opens with TZ set; the desktop panel's clock shows the zone; and the clock hint and scheduled-end or session-cap notices use it. study check prints a time zones row, study show a time zones: line, and each stream in run.json records timeZone (#1657).
• participants[].maxSessionMs caps a computer-use participant's session, counted from its own start: the participant may end its session sooner and passes as usual, and one still working at the cap gets the wind-down notice and a closing report and ends as passed with stopCause: session_cap. Its session and sandbox are sized from the cap. It is refused beside endAfterMs and on shared-world (#1800).
• participants[].files: [{ from, as }] copies files onto a hosted computer-use participant's desktop before it starts, so a browser's file chooser finds them. from is relative to the study file's folder and as to the desktop user's home. humanish reads the files before any sandbox exists, on dry runs too, and refuses a missing file, a folder, a symbolic or hard link, a path out of that folder, a .env, key or credential file, a file above 10 MiB, more than 25 MiB for one participant or 100 MiB of distinct files for one study, an absolute as or one with .., and two files at one path. After each write it checks the file's size on the desktop. The stream records desktopFiles: [{ as, size, sha256 }], never the contents (#1803).
• Each computer-use screenshot item records page: { origin, path } and the trace records finalPage, so a reader can list a participant's path through the app. The query string, fragment and user info are never kept; a path segment or host label that looks like an email address, a token or id, a key or one of the study's secrets becomes [REDACTED_URL_PART]. Pages come from Chrome or Chromium; Firefox participants and the shared-world and local browser routes record none. verify reports a page that holds a query string, fragment or user info as a public-safety finding. Both fields are additive to humanish.actor-trace.v1 (#1801).

Changed

• The served Observer's live feed sends each running participant's new items only. The page sends back the cursor its last body gave for each participant's live file (?after=<position>.<generation>.<items>.<bytes>,...), and the server reads and sends only the items past it. A new generation, a cursor the server cannot use, a finished run, a v1 or v2 run.json and a --safe server get full lists, as before. On a synthetic run of 24 participants working 8 hours, a poll sent about 90 KB in about 25 ms at 10%, 50% and 100% of the run, where 0.125.0 sent 7.0, 34.7 and 69.5 MB in 0.14, 0.63 and 1.2 s. A page's first poll is still full. A 0.125.0 page polling this server, and this page polling a 0.125.0 server, get full lists (#1766).
• The Observer's components are split so none is over 150 lines, with behavior unchanged apart from two scroll timings: the filmstrip scrolls back to the selected capture only when the selected capture changes, and reopening the inspector shows the selected entry in the activity list, where it opened at the top before (#1786).

Fixes

• A closing report at a scheduled end or a session cap now sets the trace's declaredOutcome from its first line (REACHED THE GOAL., DID NOT REACH THE GOAL. or BLOCKED.) or Codex's outcome field. A declared REACHED THE GOAL. now decides before the summary's wording, so a report that paraphrased a page's "cannot be registered" no longer counts the participant blocked and fails the run. BLOCKED. still fails it; a report that declares DID NOT REACH THE GOAL. or nothing is judged as before (#1807).

Checked before release

• CI on this PR (sharded gate on both Node versions, site, Observer proofs, TUI, guest desktop, secret scan) is the gate of record. pnpm gate on the release commit passed.
• The post-publish check rehearsed on the release tarball (pnpm packed:check): all 125 rows passed. The registry and unpkg rows run after publish.
• pnpm release:dogfood: a participant installed the tarball, ran the offline first-run study (share_ready, 16 of 16 checks, $0) and passed.
• Live on the release tarball (hosted E2B, Chrome, keys from the user store), about $0.78 of model spend plus the try-live analysis:
  • try-live with analysis: finished, analysis complete, verify 16 of 16 (local_only, raw screenshots). Each screenshot item carries a page; the diagram id in /editor/diagrams/<id> is withheld as [REDACTED_URL_PART].
  • Two participants on a page that prints the browser's JavaScript time zone, clock.timeZone Europe/London and Asia/Tokyo, each with maxSessionMs: each read its own zone in a first tab and again in a second tab (the Tokyo screenshot shows timeZone Asia/Tokyo, System Time GMT+0900, and the desktop panel's clock at 11:52 Tokyo time); run.json records each stream's timeZone; both passed, verify 16 of 16. Both participants ended their sessions themselves, so this run did not reach a session cap; the cap was shown live on the #1800 branch (a participant still working at 189.9 s ended with stopCause: session_cap and a closing report).
  • A participant given files: [{ from: fixtures/photo.png, as: Downloads/photo.png }] uploaded it on a public upload test page and passed; the stream records desktopFiles with its size and sha256.
• The time zone mechanism was measured first: TZ on the Chrome launch holds on every tab from the first page load; a CDP Emulation.setTimezoneOverride held only on its own tab while attached.
• Each change had a Codex review, and the time zone, page path and Observer feed changes a Codex design round before code; every real finding is fixed with a test or listed below.
• The benchmark was not run: no change alters what a participant is asked or what the analysis reads, apart from the time a participant sees, which the live runs above cover.

Not verified

• A live shared-world run with time zones or session caps; Firefox participants; a browser opened from the desktop's dock runs in UTC (documented).
• A library StudyConfig skips the zone parser, so an offset reaches the browser unchecked.
• At a clock end, a passing participant whose report declared DID NOT REACH THE GOAL. is still counted as reporting that it reached the goal (#1816, next release).
• A 10-minute default wind-down tells a shorter window its end from the first turn (next release).
• macOS and Windows.

Package

humanish@0.126.0: 1004 files, shasum 878695c4a0bf04fdd7b59beca574fe477ccee254.