humanish 0.127.0 → 0.128.0

package/dist/verify/costs.js

@@ -2,6 +2,7 @@
 // totals match their known lines, and account-billed participants never acquire a price.
 import { validActorExecutionProfile, validActorProviderRequests } from "../actors/contract.js";
 import { round6 } from "../run/pricing.js";
+import { keepsRequestListsInRunJson } from "../run/stream-trace.js";
 /** Account-billed participants must never acquire a price through an aggregate or ambiguous model line. */
 export function contradictsAccountBilling(streams, cost) {
     const account = (stream) => (stream.liveActor?.executionProfile ?? stream.actor?.executionProfile)?.billing ===
@@ -28,18 +29,23 @@ export function contradictsAccountBilling(streams, cost) {
  * a null estimate, or a participant without estimatedCost is fine. A non-null figure must carry its
  * ratesAsOf date + source; a number total must equal round6(sum of only the non-null lines) and a
  * null line may never be coerced to 0. A null estimate must be declared (a reason + null
- * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. Account-billed participants
- * also have their execution profile and provider request receipts checked here.
+ * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. A running participant's
+ * estimate is checked the same way. Account-billed participants also have their execution profile
+ * and provider request receipts checked here. From v4 a running participant's receipts are written
+ * only in its trace when it finishes, so its live actor holds none. The receipts of a stream in
+ * `refused` (its trace the loader refused) are not checked: from v4 they are only in that trace,
+ * and verify reports the refusal.
  */
-export function costAndReceiptFindings(bundle) {
+export function costAndReceiptFindings(bundle, refused) {
     const findings = [];
     if (contradictsAccountBilling(bundle.streams, bundle.cost))
         findings.push("Run cost lines contradict account billing identity");
     findings.push(...costSummaryFindings(bundle.cost));
+    const liveReceipts = keepsRequestListsInRunJson(bundle.schema);
     for (const stream of bundle.streams) {
-        for (const actor of [stream.actor, stream.liveActor]) {
-            findings.push(...executionReceiptFindings(actor));
-        }
+        const loaded = !refused.has(stream.id);
+        findings.push(...executionReceiptFindings(stream.actor, loaded));
+        findings.push(...executionReceiptFindings(stream.liveActor, liveReceipts && loaded));
         findings.push(...participantEstimateFindings(stream));
     }
     return findings;
@@ -81,14 +87,17 @@ function costSummaryFindings(cost) {
     }
     return findings;
 }
-/** An account-billed participant's execution profile and provider request receipts. */
-function executionReceiptFindings(actor) {
+/**
+ * An account-billed participant's execution profile and, when `receipts` says the trace holds
+ * them, its provider request receipts.
+ */
+function executionReceiptFindings(actor, receipts) {
     const findings = [];
     if (actor?.executionProfile === undefined)
         return findings;
     if (!validActorExecutionProfile(actor.executionProfile))
         findings.push("Invalid actor execution profile");
-    if (!validActorProviderRequests(actor.providerRequests))
+    if (receipts && !validActorProviderRequests(actor.providerRequests))
         findings.push("Invalid account participant request receipts");
     if (actor.historyTurnsOmitted !== undefined &&
         (!Number.isSafeInteger(actor.historyTurnsOmitted) || actor.historyTurnsOmitted < 0))
@@ -99,14 +108,20 @@ function executionReceiptFindings(actor) {
         findings.push("Account participant dollars must remain unknown");
     return findings;
 }
+/** The labeling of a participant's estimate: its finished actor's, and its live actor's while it runs. */
 function participantEstimateFindings(stream) {
+    const participantLabel = stream.laneId ?? stream.id;
+    return [
+        ...estimateFindings(stream.actor?.estimatedCost, participantLabel, "actor"),
+        ...estimateFindings(stream.liveActor?.estimatedCost, participantLabel, "live actor"),
+    ];
+}
+function estimateFindings(estimate, participantLabel, field) {
     const findings = [];
-    const estimate = stream.actor?.estimatedCost;
     if (!estimate)
         return findings;
-    const participantLabel = stream.laneId ?? stream.id;
     if (estimate.schema !== "humanish.actor-estimated-cost.v1") {
-        findings.push(`participant ${participantLabel} actor estimatedCost schema is ${String(estimate.schema)}, expected humanish.actor-estimated-cost.v1`);
+        findings.push(`participant ${participantLabel} ${field} estimatedCost schema is ${String(estimate.schema)}, expected humanish.actor-estimated-cost.v1`);
     }
     if (estimate.estimatedCostUsd !== null) {
         if (typeof estimate.ratesAsOf !== "string" || estimate.ratesAsOf.length === 0) {

package/dist/verify/verify.js

@@ -5,7 +5,7 @@ import { analysisSharingProblems } from "../analysis/sharing.js";
 import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
 import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
-import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, } from "../run/bundle.js";
+import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, RUN_BUNDLE_V3_SCHEMA, } from "../run/bundle.js";
 import { ContainedReadRefusedError, refusalText } from "../run/contained-output.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
 import { loadStreamTraces } from "../run/stream-trace.js";
@@ -139,7 +139,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
                 ? [`missing local evidence artifacts: ${missingEvidenceArtifacts.join(", ")}`]
                 : []),
     ]));
-    checks.push(...(await evidenceChecks(runPaths, bundle, cleanupRead)));
+    checks.push(...(await evidenceChecks(runPaths, bundle, cleanupRead, traces.refusedStreams)));
     const recordingOk = checks.every((check) => check.ok);
     if (derivedPublicSafetyFindings.length > 0)
         checks.push({
@@ -225,12 +225,13 @@ function evidenceArtifactsCheck(shaped, problems) {
 }
 /**
  * run.json with each stream's trace loaded, one file at a time, and the refusal of each trace that
- * does not match its index. A run.json that fails the shape guard is returned as it is.
+ * does not match its index, with the ids of those streams. A run.json that fails the shape guard
+ * is returned as it is.
  */
 async function loadTraces(runPaths, stored) {
     const scanned = { sensitive: [], opaque: [] };
     if (!isRunBundle(stored))
-        return { bundle: stored, refusedTraces: [], ...scanned, pages: [] };
+        return { bundle: stored, refusedTraces: [], refusedStreams: new Set(), ...scanned, pages: [] };
     // Each trace is source evidence: scanned by the bytes it was joined from, apart from the
     // directory walk and any path exemption the walk makes.
     const { bundle, refused } = await loadStreamTraces(runPaths, stored, {
@@ -243,6 +244,7 @@ async function loadTraces(runPaths, stored) {
     return {
         bundle,
         refusedTraces: refused.map((error) => error.message),
+        refusedStreams: new Set(refused.map((error) => error.streamId)),
         ...scanned,
         pages: pageFindings(bundle),
     };
@@ -312,7 +314,7 @@ function bundlePresenceChecks(bundleRead, review) {
                 ? `run.json declares ${String(schema)}`
                 : record === undefined
                     ? "no readable run.json, so no schema"
-                    : `run.json declares ${typeof schema === "string" ? schema : "no schema"}; verify reads ${RUN_BUNDLE_SCHEMA}, ${RUN_BUNDLE_V2_SCHEMA} and ${RUN_BUNDLE_V1_SCHEMA}`,
+                    : `run.json declares ${typeof schema === "string" ? schema : "no schema"}; verify reads ${RUN_BUNDLE_SCHEMA}, ${RUN_BUNDLE_V3_SCHEMA}, ${RUN_BUNDLE_V2_SCHEMA} and ${RUN_BUNDLE_V1_SCHEMA}`,
         },
         {
             name: "run bundle shape",
@@ -378,8 +380,12 @@ function findingsCheck(name, findings, okMessage, failLabel) {
  * check has no findings and stays ok; the shape check is the failure.
  */
 const SHAPE_UNCHECKED = "not checked, because run.json failed the shape check";
-/** The bundle-content checks, in report order. A bundle that fails its shape guard has no findings. */
-async function evidenceChecks(runPaths, bundle, cleanupRead) {
+/**
+ * The bundle-content checks, in report order. A bundle that fails its shape guard has no findings.
+ * `refusedStreams` names the streams whose traces the loader refused, which the evidence-artifacts
+ * check reports.
+ */
+async function evidenceChecks(runPaths, bundle, cleanupRead, refusedStreams) {
     const cleanupJson = runJsonValue(cleanupRead);
     const valid = isRunBundle(bundle) ? bundle : null;
     const pass = (message) => (valid ? message : SHAPE_UNCHECKED);
@@ -409,7 +415,7 @@ async function evidenceChecks(runPaths, bundle, cleanupRead) {
         // Absence passes (fail-open on display); a claimed dollar figure without its ratesAsOf date +
         // source, or a total that does not match its known lines, fails. Magnitude is never inspected:
         // a correctly-labeled huge estimate still passes.
-        findingsCheck("cost estimate labeling", valid ? costAndReceiptFindings(valid) : [], pass("every cost estimate carries its ratesAsOf date and source and the total matches its lines, or the run claims no cost"), "cost labeling findings"),
+        findingsCheck("cost estimate labeling", valid ? costAndReceiptFindings(valid, refusedStreams) : [], pass("every cost estimate carries its ratesAsOf date and source and the total matches its lines, or the run claims no cost"), "cost labeling findings"),
     ];
     return checks;
 }

package/docs/architecture/actor-contract.md

@@ -352,14 +352,18 @@ this paragraph is the record of that decision.
 
 `ComputerUseProvider.debrief` is an optional read-only request after a structured
 `stopWhen` or dwell stop. It returns a `ComputerUseTurn` with `closingReport` containing
-`summary`, `frictionReports` and `impressions`; an empty friction or impressions list is valid,
-and a report without `impressions` (an older provider) is still accepted. The loop rejects
+`outcome`, `summary`, `frictionReports` and `impressions`; an empty friction or impressions list
+is valid, and a report without `outcome` or `impressions` (an older provider) is still accepted.
+After a scheduled end or session cap, `outcome` (`reached`, `not_reached` or `blocked`) is the
+trace's `declaredOutcome`, read before the first line of `summary`. The loop rejects
 actions, pending safety checks, and invalid report shapes. It redacts accepted
 reports, records them in `ActorTrace.debrief`, and projects one readable message
 without invoking action or communication callbacks. Each impression becomes its own message
 and goes to `ActorTrace.impressions`; a session without them records why in the same field.
 A turn that ends the session itself may carry `closingReport` too, and the loop keeps its
-impressions the same way without a second request.
+impressions the same way without a second request. Its `declaredOutcome` is the report's
+`outcome`, then the turn's `outcome`, then the first line of its message, the order a closing
+report at a scheduled end is read in.
 
 `ComputerUseProvider.requestImpressions` is the optional request after the participant ended
 the session itself without impressions. It asks for impressions only, returns them as

package/docs/architecture/github-feedback-loop.md

@@ -129,7 +129,7 @@ humanish_swarm:
     - .env*
     - .github/workflows/**
     - infra/**
-  artifact_schema_version: humanish.run-bundle.v3
+  artifact_schema_version: humanish.run-bundle.v4
   credential_manifest: []
   network_policy: no_network
   spend_policy: no_spend

package/docs/architecture/observer.md

@@ -25,12 +25,17 @@ Observer commands may add derived artifacts:
 ```
 
 `run.json` remains the source bundle. `observer/observer-data.json`
-(`humanish.observer-data.v2`) is the normalized view model consumed by the Observer,
-with every participant except their trace items and the screenshot entries of their
-artifact list. A participant working for hours records thousands of items and a
-screenshot each turn, so these are most of a long run's bytes; apart, the saved file
-stays small enough for `verify` to read. The items stay in the run's traces
-(`actors/<stream>.json`). `events.ndjson` is the appendable event stream
+(`humanish.observer-data.v3`) is the normalized view model consumed by the Observer,
+with every participant except their trace items, the screenshot entries of their
+artifact list, and their per-request lists (`tokenUsage.turns`, `conversation.requests`
+and `providerRequests`, `REQUEST_LISTS` in `src/run/stream-trace.ts`), which no view
+shows. A participant working for hours records thousands of items and a screenshot each
+turn and makes a model request every few seconds, so these are most of a long run's
+bytes; apart, the saved file stays small enough for `verify` to read, and a flush does
+not rewrite them. The items and lists stay in the run's traces (`actors/<stream>.json`).
+`buildObserverData` leaves the lists out of every projection: observer-data.json, the
+page's data slot, the served feed and the HTML export. The page's validator admits an
+account participant's `executionProfile` without its receipts. `events.ndjson` is the appendable event stream
 contract that live adapters update while a run is active.
 
 `observer/index.html` carries both parts: the data slot holds observer-data.json's
@@ -41,9 +46,13 @@ trace items compress about eight times. The page joins the two before it renders
 (`joinObserverData` in `src/observer/participant-items.ts`), so every view reads the
 same data as before. A stream whose screenshot entries moved records how many in
 `screenshotArtifacts`, and the page renders nothing from items that are another
-run's or miss a participant's items or screenshot entries. The server answers a
-saved v2 observer-data.json that leaves items out as unavailable, since it has no
-items to join.
+run's or miss a participant's items or screenshot entries. The page reads only v3
+data: it checks the schema in the data slot and the feed before it validates
+(`observer/lib/data.ts`). A saved observer-data.json is read as v3
+(`observerDataFromSaved`): a v1 file, which holds the items, without its lists, and
+a v2 or v3 file only when no participant has items to join; the server answers one
+that leaves items out, or one of another schema, as unavailable. `humanish export` rebuilds a page saved as v2
+from the run and its traces, as it rebuilds a current one.
 
 ## Stream Model
 
@@ -281,7 +290,7 @@ These remain adapter work:
 ## The rendering layer
 
 The renderer is the `observer/` workspace: a Vite single-file build on the
-`@humanish` registry tokens, frozen against `humanish.observer-data.v2`
+`@humanish` registry tokens, frozen against `humanish.observer-data.v3`
 (`tests/observer/data-contract.test.ts`). The root build copies the workspace
 artifact to `dist/observer-app.html`; in a repo checkout a missing or stale
 artifact auto-builds, and an unconditional preflight at CLI startup makes a

package/docs/contracts/README.md

@@ -8,7 +8,7 @@ disagree.
   (`RunStudyOptions`) and the exports removed in 0.107.0.
 - [core.md](core.md): the records a run writes under `.humanish/runs/<id>/` and how each route
   starts a run.
-- [run-bundle.md](run-bundle.md): `humanish.run-bundle.v3`, the evidence contract that `verify`
+- [run-bundle.md](run-bundle.md): `humanish.run-bundle.v4`, the evidence contract that `verify`
   checks.
 - [policy.md](policy.md): credential, network, spend, redaction, sharing and assisted-run
   boundaries.

package/docs/contracts/run-bundle.md

@@ -1,6 +1,6 @@
 # Run Bundle Contract
 
-`humanish.run-bundle.v3` is the evidence contract. The TypeScript shape in `src/run/bundle.ts`
+`humanish.run-bundle.v4` is the evidence contract. The TypeScript shape in `src/run/bundle.ts`
 (with `streams[]` in `src/run/streams.ts` and `sharedWorld` as `SharedWorldEvidence` in
 `src/run/shared-world-evidence.ts`) and the fail-closed checks in `src/verify/verify.ts` are the
 source of truth. This page explains the stable public fields and the extension rules; it does not
@@ -39,7 +39,8 @@ trace:
 
 run.json keeps every field readers list runs by: each stream's status, judged status,
 assignment and geometry, and the actor's status, completion reason, counts, persona, debrief,
-impressions, token usage and estimated cost. Each trace is written once.
+impressions, token usage totals and estimated cost. Each trace is written once. From v4 the
+per-request lists are only in the trace file ([Per-request lists](#per-request-lists)).
 
 `trace.path` must be one of those trace file names (`actor.json`, `actors/<name>.json`,
 `actor-<name>.json`, with `<name>` a plain file name); `isStreamTracePath` in
@@ -48,7 +49,7 @@ it. Any other path, such as `observer/index.html`, fails the shape check.
 
 A reader outside humanish loads a run through the package's `loadRunBundle(cwd, run)`, with `run`
 a run id or `latest`: it returns run.json with every trace file and live file joined and checked
-as below, for v1, v2 and v3 bundles, and throws an Error named `StreamTraceRefusedError` for a
+as below, for v1, v2, v3 and v4 bundles, with each participant's per-request lists, and throws an Error named `StreamTraceRefusedError` for a
 file that does not match its index. Inside humanish, readers load a stream through
 `loadStreamTrace(runPaths, stream)`. A v1 stream returns as it is.
 An indexed stream's file is read under the 32 MiB per-file limit (analysis uses its 16 MiB
@@ -82,8 +83,8 @@ stream with a `liveActor`:
   `streams[]` (from 1). Each line is one trace item as JSON, scrubbed of the run's raw sandbox ids
   as it is appended. A live file is never truncated or rewritten;
 - in run.json, `liveActor` as `humanish.live-actor.v2`: its summary fields (`updatedAt`,
-  `persona`, `tokenUsage`, `ids`, `executionProfile`, `providerRequests`, `historyTurnsOmitted`,
-  `estimatedCost`) and, in place of `items`, the index of the prefix written so far:
+  `persona`, `tokenUsage`, `ids`, `executionProfile`, `historyTurnsOmitted`, `estimatedCost`, and
+  in v3 `providerRequests`) and, in place of `items`, the index of the prefix written so far:
 
 ```yaml
 liveActor:
@@ -122,7 +123,7 @@ Readers load live items through the same loader as traces: `loadStreamTraces` re
 indexed bytes of the live file (bytes appended after run.json was written are not read), refuses
 them unless their size, sha256 and line count match the index and each line is a JSON object,
 and returns the stream with `liveActor.items` and without `itemsFile`. It refuses a `liveActor`
-schema it does not know, and inline live items (`humanish.live-actor.v1`) in a v3 run.json. A
+schema it does not know, and inline live items (`humanish.live-actor.v1`) in a v3 or v4 run.json. A
 reader that cannot read a live file reads run.json again once and loads that bundle instead, since
 the writer may have removed a superseded generation, or every live file at finish, after the
 reader read run.json. v1 and v2 run.json keep `liveActor.items` inline (`humanish.live-actor.v1`)
@@ -138,15 +139,92 @@ used as a bundle answers 404 with the reason, never the saved projection. In saf
 (`observe --all --safe`) every read is checked against the files admitted with the run's
 share_ready verification, so a run.json changed after admission is refused and the admitted
 projection is served.
-observer-data.json is built from the loaded bundle. From 0.124.0 it is
-`humanish.observer-data.v2`: the same data without each participant's trace items, which stay in
-the traces (docs/architecture/observer.md).
+observer-data.json is built from the loaded bundle. From 0.124.0 it leaves out each participant's
+trace items, which stay in the traces, and from this release it is `humanish.observer-data.v3`,
+which also leaves out each participant's per-request lists (docs/architecture/observer.md).
+
+## Per-request lists
+
+From v4, three lists that gain one entry per model request are only in each participant's trace
+file: `tokenUsage.turns` (each request's usage), `conversation.requests` (each request's mode and,
+in explicit_context, what it carried) and `providerRequests` (an account participant's receipt for
+each dispatch). Before v4 run.json held a copy of each beside the trace file's, and a flush wrote
+every running participant's usage rows into run.json and observer-data.json. A synthetic run of
+30 participants making 2,880 requests each, written through the run writer, leaves a run.json of
+about 0.1 MB, where the same run with the lists was 16 MB with threaded conversations and 42 MB
+with account receipts. `REQUEST_LISTS` in `src/run/stream-trace.ts` names the three paths, and the
+writer, the loader and the Observer projection read it.
+
+The writer (`splitStreamTraces`) writes a finished participant's trace file as before, lists
+included, and run.json's `streams[].actor` without `items` and without the three lists:
+`tokenUsage` keeps its totals and `conversation` its `mode` and `summarizedTurns`.
+
+For a running participant, run.json's `liveActor` holds no `tokenUsage.turns` and no
+`providerRequests`. When it has `tokenUsage` and a model id in `ids.model`, the writer prices its
+rows before leaving them out and records the figure as `liveActor.estimatedCost`
+(`humanish.actor-estimated-cost.v1`, from `estimateActorCostForExecution` in
+`src/run/pricing.ts`), in place of any estimate the producer passed. The long-context tier prices
+a request by its own input size, so the totals alone can price a long session at under half its
+cost. An account participant's estimate is a null figure with the reason
+`account_billing_unknown`.
 
-Compatibility: humanish 0.122.0 and earlier read only v1 and refuse a v2 or v3 run.json by its
-schema (`run schema` fails in verify, analysis refuses the source); 0.123.0 and 0.124.0 read v1
-and v2 and refuse v3 the same way. This release reads v1 and v2 bundles as they are, with no
-migration. An exported copy (`humanish export --format bundle`) is written as v3 whatever the
-source version.
+```yaml
+liveActor:
+  schema: humanish.live-actor.v2
+  updatedAt: "<ISO timestamp>"
+  tokenUsage: { input: 412000, output: 9100, cachedInput: 380000, cacheWriteInput: 21000 }
+  ids: { model: gpt-5.6-sol }
+  estimatedCost:
+    schema: humanish.actor-estimated-cost.v1
+    estimatedCostUsd: 0.4123
+    ratesAsOf: "2026-09-03"
+    source: "<rate source>"
+  itemsFile: { path: live/1.1.ndjson, generation: 1, items: 4210, bytes: 1048211, sha256: "<hex>" }
+```
+
+The rows and receipts are written once, in the trace file, when the participant finishes. A run
+interrupted before then keeps each running participant's totals, estimate and live file. No file
+holds that participant's rows or receipts, including a receipt with `usageComplete: false` or
+`cleanup: "unconfirmed"`, so neither the trace path nor `loadRunBundle` recovers them.
+
+The loader joins the lists back for every indexed stream, whatever its version: each list the
+trace file holds goes into run.json's `tokenUsage` or `conversation` when run.json has that
+object, and `providerRequests` at the actor's top level. A v2 or v3 writer wrote run.json's copy
+and the file's from one actor, so their result does not change. A trace file whose `conversation`
+has no `requests` list, or that holds one of the three as something other than a list, is
+refused.
+
+Which writer rules the loader applies depends on the version run.json declares. A run.json that
+breaks one did not come from that version's writer, and the stream is refused before any file is
+read:
+
+| Rule                                                        | v1      | v2      | v3      | v4      |
+| ----------------------------------------------------------- | ------- | ------- | ------- | ------- |
+| Two streams index one trace file                            | refused | refused | refused | refused |
+| An actor without a trace index                              | read    | refused | refused | refused |
+| `liveActor` in a run whose `outcome.state` is `finished`    | read    | refused | refused | refused |
+| Inline live items (`humanish.live-actor.v1`)                | read    | read    | refused | refused |
+| One of the three lists in run.json's `actor` or `liveActor` | read    | read    | read    | refused |
+
+A reader that shows a run (`displayedTraces`) shows a refused stream without the lists run.json held
+for it, so run detail never prices rows the loader refused. Run detail shows a refused participant's
+cost only when run.json records an `estimatedCost` for it, since its totals alone could price under
+half of what its rows give. verify checks a running participant's `liveActor.estimatedCost` as it
+checks a finished one's: its schema, a `ratesAsOf` date and `source` beside a figure, and a reason
+beside a null figure. In a v4 run.json it no longer asks a running account participant for receipts;
+the check that account dollars stay unknown still applies, and the run still grades `local_only`
+with `RUN_NOT_FINISHED`. verify does not check the receipts of a participant whose trace the loader
+refused, in any version: the refusal fails `local evidence artifacts exist`, and from v4 the
+receipts are only in that trace.
+
+Compatibility: humanish 0.122.0 and earlier read only v1 and refuse a later run.json by its schema
+(`run schema` fails in verify, analysis refuses the source); 0.123.0 and 0.124.0 read v1 and v2
+and refuse v3 and v4 the same way. 0.125.0 and 0.126.0 read v1, v2 and v3: their verify fails
+`run schema` on a v4 run.json, their analysis refuses it, and their `loadRunBundle` returns null.
+Their Observer server and run detail parse run.json without checking its schema and show a v4
+run without the lists; the 0.126.0 page refuses an account participant's data without receipts.
+This release reads v1, v2 and v3 bundles as they are, with no migration. An exported copy
+(`humanish export --format bundle`) is written as v4 whatever the source version.
 
 ## Purpose
 
@@ -157,7 +235,7 @@ feedback drafts and future public issues.
 ## Minimum Bundle Shape
 
 ```yaml
-schema: humanish.run-bundle.v3 # v2 and v1 bundles are still read
+schema: humanish.run-bundle.v4 # v3, v2 and v1 bundles are still read
 runId: "<core run id>"
 mode: "dry-run|live"
 simCount: 1