humanish 0.122.0 → 0.123.0

package/dist/feedback/export.js

@@ -15,6 +15,7 @@ import { renderObserver } from "../observer/render.js";
 import { renderObserverHtml } from "../observer/artifact.js";
 import { buildObserverData } from "../observer/data.js";
 import { resolveRunPath } from "../run/locate.js";
+import { loadRunTraces, StreamTraceRefusedError } from "../run/stream-trace.js";
 import { verifyRun } from "../verify/verify.js";
 import {} from "../run/bundle.js";
 import { exportRedactedBundle } from "./export-bundle.js";
@@ -186,7 +187,14 @@ async function currentObserverData(runPaths, analysis, slot) {
     if (!source ||
         createHash("sha256").update(source).digest("hex") !== analysis.analysis.sourceRunSha256)
         return undefined;
-    return { value: buildObserverData(JSON.parse(source.toString("utf8"))) };
+    const stored = JSON.parse(source.toString("utf8"));
+    // A trace that no longer matches run.json's index is a source that no longer matches.
+    const bundle = await loadRunTraces(runPaths, stored).catch((error) => {
+        if (error instanceof StreamTraceRefusedError)
+            return undefined;
+        throw error;
+    });
+    return bundle === undefined ? undefined : { value: buildObserverData(bundle) };
 }
 /** Portable HTML keeps the lightweight evidence; media remains in the source run. */
 function omitRecordings(data) {

package/dist/observer/run-routes.js

@@ -1,6 +1,7 @@
 // HTTP handlers for one run's Observer: the page, its data with live status and runtime stream
 // URLs, its analysis, and its media with byte ranges. serveObserver (render.ts) and the library
 // server (serve.ts) both route requests through them.
+import { lstat } from "node:fs/promises";
 import path from "node:path";
 import { isAnalysisRecordPath, projectShareCheckedAnalysis } from "../analysis/sharing.js";
 import { loadAnalysis } from "../analysis/load.js";
@@ -9,6 +10,8 @@ import { listRuns } from "../run/stored-runs.js";
 import { readAnalysisAccounting } from "../run/costs.js";
 import { bindExistingRunArtifactPaths, isPathInside, isSafeRunIdSegment, } from "../run/paths.js";
 import { isRunOutcome } from "../run/bundle-shape.js";
+import { displayedTraces, loadStreamTraces } from "../run/stream-trace.js";
+import { isNodeError, isRecord } from "../run/type-guards.js";
 import { MAX_NOTE_FILE_BYTES, readRunNotes, RUN_NOTES_DIR, } from "../run/note-files.js";
 import { analysisCostOf, runCost, runCostLabel } from "../run/run-cost.js";
 import { RUN_STATUS_FILE, RUN_STATUS_STALE_MS, isRunStatusRecord, } from "../run/status.js";
@@ -99,9 +102,9 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
         return;
     }
     if (cleanedRelativePath === "observer/index.html") {
-        const observerData = await readObserverData(runRoot, runtimeStreamUrls);
-        if (!observerData) {
-            writeResponse(response, 404, "Observer data not found", "text/plain; charset=utf-8");
+        const observerData = await observerDataOrReason(runRoot, runtimeStreamUrls);
+        if ("unavailable" in observerData) {
+            writeResponse(response, 404, `Observer data not found: ${observerData.unavailable}`, "text/plain; charset=utf-8");
             return;
         }
         const analysis = await readObserverAnalysis(runRoot);
@@ -114,9 +117,9 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
         return;
     }
     if (cleanedRelativePath === "observer/observer-data.json") {
-        const observerData = await readObserverData(runRoot, runtimeStreamUrls);
-        if (!observerData) {
-            writeResponse(response, 404, "Observer data not found", "text/plain; charset=utf-8");
+        const observerData = await observerDataOrReason(runRoot, runtimeStreamUrls);
+        if ("unavailable" in observerData) {
+            writeResponse(response, 404, `Observer data not found: ${observerData.unavailable}`, "text/plain; charset=utf-8");
             return;
         }
         writeResponse(response, 200, JSON.stringify(observerData, null, 2), "application/json; charset=utf-8");
@@ -153,29 +156,69 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
         writeResponse(response, 404, "Not found", "text/plain; charset=utf-8");
     }
 }
+/** The run's trace files, read through its pinned folder. */
+function pinnedTraceReader(runRoot) {
+    return async (relativePath, maxBytes) => {
+        const bytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, relativePath), {
+            maxBytes,
+        }).catch(() => null);
+        return bytes === null ? { refused: `${relativePath} could not be read` } : { bytes };
+    };
+}
 async function readObserverData(runRoot, runtimeStreamUrls = []) {
+    const read = await observerDataOrReason(runRoot, runtimeStreamUrls);
+    return "unavailable" in read ? null : read;
+}
+/**
+ * The run's Observer data, or why there is none. run.json is the source: each trace is loaded
+ * through the loader, and a participant whose trace it refuses shows as unavailable, with no
+ * fallback. The saved observer-data.json is read only while the run has no run.json at all, or in
+ * safe serving, where only its admitted bytes can be read. Otherwise a run.json that is there and
+ * cannot be read, parsed or used as a bundle (which a browser poll can meet mid-write) gives the
+ * reason, a 404 the poller retries, never the saved projection.
+ */
+async function observerDataOrReason(runRoot, runtimeStreamUrls) {
     const record = await readLocalRunStatus(runRoot);
-    // Best-effort load from either source. Both reads swallow all errors on
-    // purpose: this runs on every browser poll of a live run, where run.json may
-    // be absent, still being written (a partial-JSON parse error), or superseded
-    // by observer-data.json. A transient failure just falls through to the next
-    // source, or to null -> a 404 the poller retries; it must not surface a 500.
+    const runJson = path.join(runRoot.physicalPath, "run.json");
+    const bundleBytes = await readContainedFile(runRoot, runJson).catch(() => null);
+    const absent = bundleBytes === null &&
+        (await lstat(runJson).then(() => false, (error) => isNodeError(error) && error.code === "ENOENT"));
+    // A root admitted for safe serving checks every read against the identity and digest admitted
+    // with the run's share_ready verification, so a run.json changed since then is refused, and the
+    // saved projection it may serve is the one admitted with the verified run.
+    if (absent || (bundleBytes === null && runRoot.admitsContent !== undefined))
+        return savedObserverData(runRoot, record, runtimeStreamUrls);
+    if (bundleBytes === null)
+        return { unavailable: "run.json is there but could not be read: it is a link or changed." };
+    let stored;
+    try {
+        const parsed = JSON.parse(bundleBytes.toString("utf8"));
+        if (!isRecord(parsed) || !Array.isArray(parsed.streams))
+            throw new Error("not a run bundle");
+        stored = parsed;
+    }
+    catch {
+        return { unavailable: "run.json is not a run bundle; it may be mid-write, so try again." };
+    }
     try {
-        const bundleBytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, "run.json"));
-        if (!bundleBytes)
-            throw new Error("run.json unavailable");
-        const bundle = JSON.parse(bundleBytes.toString("utf8"));
+        const bundle = displayedTraces(await loadStreamTraces(pinnedTraceReader(runRoot), stored));
         return withRuntimeStreamUrls(withLocalRunStatus(record, buildObserverData(bundle, undefined, record), bundle.outcome), runtimeStreamUrls);
     }
-    catch { }
+    catch {
+        return { unavailable: "run.json could not be shown as a run." };
+    }
+}
+/** The saved observer-data.json of a run that has written no run.json yet. */
+async function savedObserverData(runRoot, record, runtimeStreamUrls) {
     try {
         const observerBytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, "observer", "observer-data.json"));
         if (!observerBytes)
             throw new Error("observer-data.json unavailable");
         return withRuntimeStreamUrls(withLocalRunStatus(record, withObserverEndings(JSON.parse(observerBytes.toString("utf8")))), runtimeStreamUrls);
     }
-    catch { }
-    return null;
+    catch {
+        return { unavailable: "The run has written no run.json or Observer data yet." };
+    }
 }
 /** The run directory's own status record, when it is well formed and names that directory. */
 async function readLocalRunStatus(runRoot) {

package/dist/run/bundle-shape.js

@@ -1,6 +1,6 @@
 import { isCommsReceivingEvidence } from "../comms/receiving-evidence.js";
 import { isCapturedGitState } from "./git-state.js";
-import { PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA, } from "./bundle.js";
+import { PUBLIC_TARGET_CWD, REVIEW_SCHEMA, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, } from "./bundle.js";
 import { CLEANUP_SCHEMA, } from "./results.js";
 import { isRunSimulationStatus, isRunStream, isRunStreamKind } from "./stream-shape.js";
 import { isLocalEvidenceArtifactPath } from "./paths.js";
@@ -10,7 +10,7 @@ import { isSharedWorldEvidence } from "./shared-world-shape.js";
 import { isNonNegativeSafeInteger, isPositiveSafeInteger, isRecord } from "./type-guards.js";
 export function isRunBundle(value) {
     return (isRecord(value) &&
-        value.schema === RUN_BUNDLE_SCHEMA &&
+        (value.schema === RUN_BUNDLE_SCHEMA || value.schema === RUN_BUNDLE_V1_SCHEMA) &&
         (value.commsReceiving === undefined || isCommsReceivingEvidence(value.commsReceiving)) &&
         (value.publication === undefined ||
             (isRecord(value.publication) &&

package/dist/run/bundle.d.ts

@@ -5,7 +5,10 @@ import type { SharedWorldEvidence } from "./shared-world-evidence.js";
 import { type RunStudyProvenance } from "./study-provenance.js";
 import type { RunInterruptSignal } from "./status.js";
 import type { RunSimulationStatus, RunStream, RunStreamKind } from "./streams.js";
-export declare const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v1";
+/** The run bundle version this release writes: each stream's trace is a file run.json indexes. */
+export declare const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v2";
+/** The version 0.122.0 and earlier wrote, with every trace inline. It is still read. */
+export declare const RUN_BUNDLE_V1_SCHEMA = "humanish.run-bundle.v1";
 /** The run bundle file, relative to the run directory. */
 export declare const RUN_BUNDLE_FILE = "run.json";
 export declare const REVIEW_SCHEMA = "humanish.review.v1";
@@ -228,7 +231,7 @@ export interface RunBundle {
         restrictions: ["real-communications"];
     };
     commsReceiving?: CommsReceivingEvidence;
-    schema: typeof RUN_BUNDLE_SCHEMA;
+    schema: typeof RUN_BUNDLE_SCHEMA | typeof RUN_BUNDLE_V1_SCHEMA;
     runId: string;
     mode: "dry-run" | "live";
     simCount: number;

package/dist/run/bundle.js

@@ -1,7 +1,10 @@
 import path from "node:path";
 import { captureGitState } from "./git-state.js";
 import { studyFields } from "./study-provenance.js";
-export const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v1";
+/** The run bundle version this release writes: each stream's trace is a file run.json indexes. */
+export const RUN_BUNDLE_SCHEMA = "humanish.run-bundle.v2";
+/** The version 0.122.0 and earlier wrote, with every trace inline. It is still read. */
+export const RUN_BUNDLE_V1_SCHEMA = "humanish.run-bundle.v1";
 /** The run bundle file, relative to the run directory. */
 export const RUN_BUNDLE_FILE = "run.json";
 export const REVIEW_SCHEMA = "humanish.review.v1";

package/dist/run/detail.d.ts

@@ -36,6 +36,12 @@ export interface RunParticipant {
     thoughts?: number;
     /** `null` when declared absent; absent when never recorded. Never coerced to 0. */
     estimatedCostUsd?: number | null;
+    /**
+     * Why this participant's evidence cannot be shown: the loader refused its trace (a file that does
+     * not match run.json, or run.json items no trace file binds). The participant then has no
+     * thought or thought count.
+     */
+    evidenceUnavailable?: string;
 }
 export interface RunDetail {
     automaticAnalysis?: AutomaticAnalysisView;

package/dist/run/detail.js

@@ -16,6 +16,7 @@ import { savedCaption } from "./participant-caption.js";
 import { recordedPersonaId, streamParticipantIdOf } from "./participant-records.js";
 import { ContainedReadRefusedError, readContainedRegularFile, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
 import { isPathInside, resolvePhysicalCwd } from "./paths.js";
+import { displayedTraces, loadStreamTraces } from "./stream-trace.js";
 const RUN_DETAIL_SCHEMA = "humanish.run-detail.v1";
 /**
  * The latest reasoning a participant has recorded.
@@ -72,6 +73,9 @@ function participantFrom(stream, index, savedPersonaId) {
         ...(typeof trace.counts?.actions === "number" ? { actions: trace.counts.actions } : {}),
         ...(thoughts > 0 ? { thoughts } : {}),
         ...costOf(trace),
+        ...(stream.traceUnavailable === undefined
+            ? {}
+            : { evidenceUnavailable: stream.traceUnavailable }),
     };
 }
 /**
@@ -103,6 +107,15 @@ function costOf(trace) {
         return {};
     }
 }
+/**
+ * The run's streams with their traces loaded through the loader and its bundle rules, as a screen
+ * shows them: a participant whose trace the loader refused carries the reason and none of the
+ * items run.json or a file supplied for it.
+ */
+async function displayedStreams(runPaths, streams, bundle) {
+    const loaded = await loadStreamTraces(runPaths, { ...bundle, streams });
+    return displayedTraces(loaded).streams;
+}
 /**
  * Read one run's participants. Returns null when the run has no readable bundle yet, an ordinary
  * state for a run that has just started, not a failure. Throws when run.json is there and cannot
@@ -138,7 +151,7 @@ export async function readRunDetail(cwdInput, runId) {
         // Absent or torn: the run has not written one yet, or is writing it now.
         return null;
     }
-    const streams = Array.isArray(bundle.streams) ? bundle.streams : [];
+    const streams = await displayedStreams(runPaths, Array.isArray(bundle.streams) ? bundle.streams : [], bundle);
     const observerAbsolute = path.join(runPaths.absoluteRunRoot, "observer", "index.html");
     const automaticAnalysis = await readAutomaticAnalysis(cwd, runId);
     return {

package/dist/run/locate.js

@@ -3,6 +3,7 @@ import { bindExistingRunArtifactPaths, isSafeRunIdSegment, resolveExistingRunDir
 import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, ContainedReadRefusedError, LATEST_POINTER_MAX_BYTES, readContainedRegularFile, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
 import { RUN_BUNDLE_FILE } from "./bundle.js";
 import { isRunBundle, isRunPointer } from "./bundle-shape.js";
+import { loadRunTraces } from "./stream-trace.js";
 import { readUnchangedFile } from "./evidence-files.js";
 /** The run input that resolves through latest.json rather than naming a run directory. */
 export const LATEST_RUN_ALIAS = "latest";
@@ -122,7 +123,8 @@ export async function loadRunBundlePrepared(cwdInput, runPaths) {
         return null;
     }
     return {
-        bundle,
+        // A trace that does not match its index throws StreamTraceRefusedError, naming the participant.
+        bundle: await loadRunTraces(runPaths, bundle),
         bundlePath: path.relative(cwd, bundlePath),
         runDir: runPaths.absoluteRunRoot,
     };

package/dist/run/projection.d.ts

@@ -1,3 +1,4 @@
+import type { RunParticipant } from "./detail.js";
 import type { RunIndexEntry } from "./run-index.js";
 /** One study as the study list shows it. */
 export interface StudyRollup {
@@ -72,6 +73,12 @@ export interface NormalizedThought {
     /** True when the source text did not fit and was cut; shown, never silent. */
     truncated: boolean;
 }
+/**
+ * What a screen quotes for a participant of a run detail: why its evidence is unavailable, else
+ * its latest thought. It lives here, beside normalizeThought, so the TUI bundle does not load the
+ * run-detail reader.
+ */
+export declare function participantNote(participant: Pick<RunParticipant, "evidenceUnavailable" | "thought">): string | undefined;
 /**
  * Prepare a participant's recorded reasoning summary for a fixed-width surface. Provider summaries
  * arrive with markdown section leads (`**Thinking through setup**`) and hard newlines; a terminal

package/dist/run/projection.js

@@ -162,6 +162,16 @@ export function formatDuration(ms) {
     const hours = Math.floor(minutes / 60);
     return minutes % 60 === 0 ? `${hours}h` : `${hours}h ${minutes % 60}m`;
 }
+/**
+ * What a screen quotes for a participant of a run detail: why its evidence is unavailable, else
+ * its latest thought. It lives here, beside normalizeThought, so the TUI bundle does not load the
+ * run-detail reader.
+ */
+export function participantNote(participant) {
+    return participant.evidenceUnavailable === undefined
+        ? participant.thought?.text
+        : `Evidence unavailable: ${participant.evidenceUnavailable}`;
+}
 /**
  * Prepare a participant's recorded reasoning summary for a fixed-width surface. Provider summaries
  * arrive with markdown section leads (`**Thinking through setup**`) and hard newlines; a terminal

package/dist/run/run.js

@@ -17,6 +17,7 @@ import { RunSecrets } from "./secrets.js";
 import { RUN_STATUS_FILE, beginRunStatus, runStatusOutcome, } from "./status.js";
 import { readRunJsonIfExists, runJsonValue } from "./locate.js";
 import { hostSuspensionEvents, systemHostClock, } from "./host-suspension.js";
+import { splitStreamTraces } from "./stream-trace.js";
 /** An entry point called in a state that does not admit it. */
 class RunLifecycleError extends Error {
     name = "RunLifecycleError";
@@ -171,7 +172,12 @@ function runPublisher(args) {
             cwd: PUBLIC_TARGET_CWD,
             ...(recorded === undefined ? {} : { outcome: recorded }),
         });
-        await writeContainedOutputFile(paths, RUN_BUNDLE_FILE, json(publicBundle), "utf8");
+        // Each trace file first, so run.json never indexes a file that is not yet written. The review
+        // and the Observer data below read the whole in-memory bundle.
+        const split = splitStreamTraces(publicBundle);
+        for (const file of split.files)
+            await writeContainedOutputFile(paths, file.path, file.bytes);
+        await writeContainedOutputFile(paths, RUN_BUNDLE_FILE, json(split.bundle), "utf8");
         await afterBundle(publicBundle);
         // The run writes its own status.json; one it refuses renders as a missing one does.
         const status = recorded === undefined

package/dist/run/stored-runs.js

@@ -4,11 +4,12 @@ import { redactText } from "../evidence/redaction.js";
 import { bindExistingRunArtifactPaths, RUNS_RELATIVE_ROOT, isSafeRunIdSegment, resolveRunsRoot, } from "./paths.js";
 import { assertPreparedSelectedOutputDirectory, bindExistingManagedHumanishOutputDirectory, refusalText, } from "./contained-output.js";
 import { RUN_BUNDLE_FILE } from "./bundle.js";
-import { isReviewSummary, isRunOutcome } from "./bundle-shape.js";
+import { isReviewSummary, isRunBundle, isRunOutcome } from "./bundle-shape.js";
 import { bundleDisplayFacts, displayedReview, runDisplay, } from "./display.js";
 import { RUN_STATUS_FILE } from "./status.js";
 import { readLatest, readRunJsonIfExists, resolveRunPath, runJsonValue } from "./locate.js";
 import { withCuaReviewProvenance } from "./outcomes.js";
+import { displayedTraces, loadStreamTraces } from "./stream-trace.js";
 import { isNodeError, isRecord } from "./type-guards.js";
 import { invalidRunStorageVerifyResult, verifyResolvedRun, } from "../verify/verify.js";
 const RUNS_SCHEMA = "humanish.runs-result.v1";
@@ -174,9 +175,14 @@ export async function readReview(cwdInput, runInput) {
     const bundle = runPaths
         ? runJsonValue(await readRunJsonIfExists(runPaths, RUN_BUNDLE_FILE))
         : null;
-    const projected = isRecord(bundle) && Array.isArray(bundle.streams)
-        ? withCuaReviewProvenance(review, bundle.streams.filter(isRecord))
-        : review;
+    // The completion provenance reads each participant's items, loaded through the loader; a
+    // participant whose trace it refused counts without them.
+    const streams = runPaths && isRunBundle(bundle)
+        ? displayedTraces(await loadStreamTraces(runPaths, bundle)).streams
+        : isRecord(bundle) && Array.isArray(bundle.streams)
+            ? bundle.streams.filter(isRecord)
+            : undefined;
+    const projected = streams ? withCuaReviewProvenance(review, streams) : review;
     const displayed = displayedBundle(bundle);
     const { display } = runPaths ? await listedRunDisplay(runPaths, bundle) : {};
     return {

package/dist/run/stream-shape.d.ts

@@ -1,4 +1,14 @@
-import { type RunSimulationStatus, type RunStream, type RunStreamKind } from "./streams.js";
+import { type RunSimulationStatus, type RunStream, type RunStreamKind, type StreamTraceIndex } from "./streams.js";
 export declare function isRunStream(value: unknown): value is RunStream;
+export declare function isRunStreamArtifact(value: unknown): value is RunStream["artifacts"][number];
+/**
+ * The trace file names the run writer produces: actor.json for one participant,
+ * actors/<stream>.json for more, actor-<surface>.json on the scripted route. A trace is source
+ * evidence, so an index naming any other file (the Observer page, which the public-safety scan
+ * reads as a regenerated projection) is refused by the shape check and by the loader.
+ */
+export declare function isStreamTracePath(value: string): boolean;
+/** A v2 stream's index of its trace file: a local path, its size and sha256, and what it holds. */
+export declare function isStreamTraceIndex(value: unknown): value is StreamTraceIndex;
 export declare function isRunSimulationStatus(value: unknown): value is RunSimulationStatus;
 export declare function isRunStreamKind(value: unknown): value is RunStreamKind;

package/dist/run/stream-shape.js

@@ -2,7 +2,7 @@
 import { desktopRecordingMetadataSchema, } from "../evidence/desktop-recording-types.js";
 import { isLocalEvidenceArtifactPath } from "./paths.js";
 import {} from "./streams.js";
-import { isFiniteNumber, isPositiveFiniteNumber, isRecord } from "./type-guards.js";
+import { isFiniteNumber, isNonNegativeSafeInteger, isPositiveFiniteNumber, isRecord, } from "./type-guards.js";
 export function isRunStream(value) {
     return (isRecord(value) &&
         typeof value.id === "string" &&
@@ -21,6 +21,7 @@ export function isRunStream(value) {
         (value.desktopGeometry === undefined || isRunDesktopGeometry(value.desktopGeometry)) &&
         (value.recording === undefined || isRunDesktopRecording(value.recording)) &&
         hasConsistentStreamGeometry(value) &&
+        (value.trace === undefined || isStreamTraceIndex(value.trace)) &&
         Array.isArray(value.artifacts) &&
         value.artifacts.every(isRunStreamArtifact) &&
         hasConsistentRecordingArtifact(value.recording, value.artifacts));
@@ -120,7 +121,7 @@ function hasConsistentStreamGeometry(value) {
 function isMeasuredSize(value) {
     return (isRecord(value) && isPositiveFiniteNumber(value.width) && isPositiveFiniteNumber(value.height));
 }
-function isRunStreamArtifact(value) {
+export function isRunStreamArtifact(value) {
     return (isRecord(value) &&
         typeof value.label === "string" &&
         typeof value.path === "string" &&
@@ -134,6 +135,29 @@ function isRunStreamArtifact(value) {
             value.kind === "filesystem" ||
             value.kind === "recording"));
 }
+/** A name part of a trace file: a stream id or surface id that is a plain file name. */
+const TRACE_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,127}";
+const TRACE_FILE = new RegExp(`^(?:actor|actor-${TRACE_NAME}|actors/${TRACE_NAME})\\.json$`);
+/**
+ * The trace file names the run writer produces: actor.json for one participant,
+ * actors/<stream>.json for more, actor-<surface>.json on the scripted route. A trace is source
+ * evidence, so an index naming any other file (the Observer page, which the public-safety scan
+ * reads as a regenerated projection) is refused by the shape check and by the loader.
+ */
+export function isStreamTracePath(value) {
+    return TRACE_FILE.test(value);
+}
+/** A v2 stream's index of its trace file: a local path, its size and sha256, and what it holds. */
+export function isStreamTraceIndex(value) {
+    return (isRecord(value) &&
+        typeof value.path === "string" &&
+        isStreamTracePath(value.path) &&
+        isNonNegativeSafeInteger(value.bytes) &&
+        typeof value.sha256 === "string" &&
+        /^[0-9a-f]{64}$/.test(value.sha256) &&
+        isNonNegativeSafeInteger(value.items) &&
+        isNonNegativeSafeInteger(value.screenshots));
+}
 export function isRunSimulationStatus(value) {
     return (value === "queued" ||
         value === "preparing" ||

package/dist/run/stream-trace.d.ts

@@ -0,0 +1,68 @@
+import { type RunBundle } from "./bundle.js";
+import { type PreparedOutputRoot } from "./contained-output.js";
+import type { RunStream } from "./streams.js";
+/** A trace that does not match its index, or cannot be read. The message names the stream. */
+export declare class StreamTraceRefusedError extends Error {
+    readonly streamId: string;
+    constructor(streamId: string, detail: string);
+}
+/**
+ * The run.json the run writes, and the trace files it writes first. Each stream with a finished
+ * actor keeps that actor without `items`, its artifacts other than screenshots, and an index of its
+ * trace file; the file is the actor trace with the stream's screenshot entries as `artifacts`. A
+ * stream already split (its actor read back from a v2 run.json without its items) keeps its index,
+ * since its file is on disk.
+ */
+export declare function splitStreamTraces(bundle: RunBundle): {
+    bundle: RunBundle;
+    files: {
+        path: string;
+        bytes: Buffer;
+    }[];
+};
+/**
+ * Where a loader reads trace files from: the bytes at a run-relative path, at most `maxBytes`, or
+ * why it could not. Prepared run paths read through the contained reader; the Observer server
+ * passes a reader over its pinned run folder.
+ */
+export type TraceFileReader = (relativePath: string, maxBytes: number) => Promise<{
+    bytes: Buffer;
+} | {
+    refused: string;
+}>;
+/**
+ * The stream as a v1 run.json held it: its actor with every item and every artifact entry. A
+ * stream without an index is returned as it is (a v1 stream, or one with no actor). An indexed
+ * stream's file must have a trace file name (isStreamTracePath); it is read under `maxBytes` and
+ * checked against the index's byte count, sha256, item count and screenshot count, and any
+ * difference throws StreamTraceRefusedError. The rules that need the whole bundle (an unindexed v2
+ * actor, two participants indexing one file) are loadStreamTraces'.
+ */
+export declare function loadStreamTrace(runPaths: PreparedOutputRoot, stream: RunStream, maxBytes?: number): Promise<RunStream>;
+/**
+ * Every stream of the bundle loaded through loadStreamTrace, one file at a time, and the refusal
+ * of each stream that could not be (see bundleRefusal for the rules that need the whole bundle).
+ * Each refused stream is kept as run.json holds it; a reader that shows the run passes the result
+ * to displayedTraces. `source` is the run's prepared paths, or a TraceFileReader. `onTrace`
+ * receives each trace file's path and the bytes the stream was joined from, after they matched
+ * the index, so a caller scans exactly what it reads.
+ */
+export declare function loadStreamTraces(source: PreparedOutputRoot | TraceFileReader, bundle: RunBundle, options?: {
+    maxBytes?: number;
+    onTrace?: (path: string, bytes: Buffer) => void;
+}): Promise<{
+    bundle: RunBundle;
+    refused: StreamTraceRefusedError[];
+}>;
+/**
+ * A loaded bundle as a reader that shows a run presents it. A refused stream keeps run.json's
+ * summary, shows none of the items run.json or a file supplied for it (its actor's items, its
+ * in-progress items, its screenshot entries), and carries `traceUnavailable` with the reason; a
+ * warn event on its timeline says the same.
+ */
+export declare function displayedTraces(loaded: {
+    bundle: RunBundle;
+    refused: readonly StreamTraceRefusedError[];
+}): RunBundle;
+/** The bundle with every stream loaded; the first refusal throws. */
+export declare function loadRunTraces(source: PreparedOutputRoot | TraceFileReader, bundle: RunBundle, maxBytes?: number): Promise<RunBundle>;