humanish 0.127.1 → 0.129.0

package/dist/run/stream-trace.js

@@ -1,25 +1,37 @@
 // Where a participant's trace lives. A v1 run.json holds every stream's trace items and screenshot
 // entries inline. From v2 the run writer moves them into one file per stream and leaves an index
 // in run.json, so run.json stays a summary whatever the length of the sessions. From v3 a running
-// participant's items so far are in a live file run.json indexes too (src/run/live-items.ts).
-// Every reader that needs the items loads them here, which accepts every version and checks each
-// file against its index.
+// participant's items so far are in a live file run.json indexes too (src/run/live-items.ts). From
+// v4 the per-request lists (REQUEST_LISTS) are only in the trace file, and a running participant
+// carries its totals and the estimate priced from its rows. Every reader that needs the items or
+// the lists loads them here, which accepts every version and checks each file against its index.
 import { createHash } from "node:crypto";
-import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V2_SCHEMA, } from "./bundle.js";
+import { RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V2_SCHEMA, RUN_BUNDLE_V3_SCHEMA, } from "./bundle.js";
 import { isRunBundle } from "./bundle-shape.js";
 import { readContainedPrefix, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, } from "./contained-output.js";
 import { isLiveItemsIndex, LIVE_ACTOR_SCHEMA, LIVE_ACTOR_V1_SCHEMA, liveItemsAfter, liveItemsFromBytes, } from "./live-items.js";
+import { estimateActorCostForExecution } from "./pricing.js";
 import { isRunStreamArtifact, isStreamTraceIndex, isStreamTracePath } from "./stream-shape.js";
 import { isRecord } from "./type-guards.js";
-/** A trace that does not match its index, or cannot be read. The message names the stream. */
+/**
+ * A trace that does not match its index, or cannot be read. The message names the stream, and ends
+ * with `advice`: by default, restore the run folder from a copy.
+ */
 export class StreamTraceRefusedError extends Error {
     streamId;
-    constructor(streamId, detail) {
-        super(`Participant ${streamId}'s trace was not read: ${detail}. A trace file must stay as the run wrote it; restore the run folder from a copy.`);
+    constructor(streamId, detail, advice = "A trace file must stay as the run wrote it; restore the run folder from a copy.") {
+        super(`Participant ${streamId}'s trace was not read: ${detail}. ${advice}`);
         this.streamId = streamId;
         this.name = "StreamTraceRefusedError";
     }
 }
+/** Why the loader reads no trace or live file whose index records more than `maxBytes`. */
+const pastLimitDetail = (index, maxBytes) => `run.json records ${index.path} at ${index.bytes} bytes, more than the ${maxBytes} bytes humanish reads of one file`;
+/**
+ * The refusal of a trace or live file whose index records more than `maxBytes`. The loader reads
+ * no file past the limit, so a copy of the file is refused too.
+ */
+const tooLarge = (streamId, index, maxBytes) => new StreamTraceRefusedError(streamId, pastLimitDetail(index, maxBytes), "Restoring a copy does not help; open the file with another tool, such as jq, to read its items.");
 const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const isScreenshot = (artifact) => artifact.kind === "screenshot";
 /**
@@ -43,12 +55,64 @@ function tracePath(stream, index, claimed) {
         !POSITION_TRACE_FILE.test(artifact.path))?.path;
     return own !== undefined && !claimed.has(traceFileKey(own)) ? own : `actors/${index + 1}.json`;
 }
+/**
+ * A participant's lists that gain one entry per model request, as paths into its actor trace. From
+ * run bundle v4 run.json leaves them out of `actor` and `liveActor`, and the trace file alone holds
+ * them; the Observer's data leaves them out too.
+ */
+const REQUEST_LISTS = ["tokenUsage.turns", "conversation.requests", "providerRequests"];
+/** The value at `list`'s path in `trace`, when the object holding it is there. */
+function listIn(trace, list) {
+    const [first, second] = list.split(".");
+    if (second === undefined)
+        return trace[first];
+    const parent = trace[first];
+    return isRecord(parent) ? parent[second] : undefined;
+}
+/** `trace` without the per-request lists; every other field as it is. */
+export function withoutRequestLists(trace) {
+    const copy = { ...trace };
+    for (const list of REQUEST_LISTS) {
+        const [first, second] = list.split(".");
+        const parent = copy[first];
+        if (second === undefined)
+            delete copy[first];
+        else if (isRecord(parent) && second in parent) {
+            const { [second]: _list, ...rest } = parent;
+            copy[first] = rest;
+        }
+    }
+    return copy;
+}
+/** The first per-request list `trace` holds, if any. */
+function heldRequestList(trace) {
+    return REQUEST_LISTS.find((list) => listIn(trace, list) !== undefined);
+}
+/**
+ * run.json's live actor: without the per-request lists, and with the estimate priced from the
+ * rows it leaves out. Long-context pricing needs each request's input size, so a figure priced
+ * from the totals alone could be under half the real one. A live actor read back from run.json
+ * has no rows and keeps the estimate they gave.
+ */
+function liveSummary(live) {
+    const summary = withoutRequestLists(live);
+    const model = live.ids?.model;
+    if (live.tokenUsage === undefined || typeof model !== "string")
+        return summary;
+    if (live.tokenUsage.turns === undefined && live.estimatedCost !== undefined)
+        return summary;
+    return {
+        ...summary,
+        estimatedCost: estimateActorCostForExecution(live.tokenUsage, model, live.executionProfile),
+    };
+}
 /**
  * The run.json the run writes, and the trace files it writes first. Each stream with a finished
- * actor keeps that actor without `items`, its artifacts other than screenshots, and an index of its
- * trace file; the file is the actor trace with the stream's screenshot entries as `artifacts`. A
- * stream already split (its actor read back from a v2 run.json without its items) keeps its index,
- * since its file is on disk.
+ * actor keeps that actor without `items` and the per-request lists, its artifacts other than
+ * screenshots, and an index of its trace file; the file is the whole actor trace with the stream's
+ * screenshot entries as `artifacts`. A stream already split (its actor read back from run.json
+ * without its items) keeps its index, since its file is on disk, and loses any lists an older
+ * run.json held beside it. A running participant's live actor is written by liveSummary.
  */
 export function splitStreamTraces(bundle) {
     const files = [];
@@ -56,10 +120,15 @@ export function splitStreamTraces(bundle) {
     for (const stream of bundle.streams)
         if (stream.trace)
             claimed.add(traceFileKey(stream.trace.path));
-    const streams = bundle.streams.map((stream, index) => {
+    const streams = bundle.streams.map((written, index) => {
+        const stream = written.liveActor === undefined
+            ? written
+            : { ...written, liveActor: liveSummary(written.liveActor) };
         const actor = stream.actor;
-        if (actor === undefined || !Array.isArray(actor.items))
+        if (actor === undefined)
             return stream;
+        if (!Array.isArray(actor.items))
+            return { ...stream, actor: withoutRequestLists(actor) };
         const { trace: _previous, ...rest } = stream;
         const filePath = tracePath(rest, index, claimed);
         // Only a stream already split that moved position can hold this stream's position name.
@@ -72,8 +141,8 @@ export function splitStreamTraces(bundle) {
         const { items, ...summary } = actor;
         return {
             ...rest,
-            // run.json's actor is the summary: every field of the trace except its items.
-            actor: summary,
+            // run.json's actor is the summary: every field of the trace except its items and lists.
+            actor: withoutRequestLists(summary),
             artifacts: stream.artifacts.filter((artifact) => !isScreenshot(artifact)),
             trace: {
                 path: filePath,
@@ -125,13 +194,38 @@ function joinTrace(stream, bytes) {
         refuse(`${index.path} lists an artifact that is not a screenshot entry`);
     if (value.items.length !== index.items || artifacts.length !== index.screenshots)
         refuse(`${index.path} holds ${value.items.length} items and ${artifacts.length} screenshots and run.json records ${index.items} and ${index.screenshots}`);
+    const actor = joinRequestLists(stream.actor, value, index.path, refuse);
     const { trace: _index, ...rest } = stream;
     return {
         ...rest,
-        actor: { ...stream.actor, items: value.items },
+        actor: { ...actor, items: value.items },
         artifacts: [...stream.artifacts, ...artifacts],
     };
 }
+/**
+ * run.json's actor with each per-request list its trace file holds, whatever the bundle's
+ * version: before v4 the writer wrote run.json's lists and the file's from one actor, so they are
+ * equal. A nested list goes into run.json's `tokenUsage` or `conversation` when run.json has it.
+ */
+function joinRequestLists(summary, file, filePath, refuse) {
+    if (isRecord(file.conversation) && !Array.isArray(file.conversation.requests))
+        refuse(`${filePath} records a conversation without its requests list`);
+    const joined = { ...summary };
+    for (const list of REQUEST_LISTS) {
+        const value = listIn(file, list);
+        if (value === undefined)
+            continue;
+        if (!Array.isArray(value))
+            refuse(`${filePath} holds ${list} as something other than a list`);
+        const [first, second] = list.split(".");
+        const parent = joined[first];
+        if (second === undefined)
+            joined[first] = value;
+        else if (isRecord(parent))
+            joined[first] = { ...parent, [second]: value };
+    }
+    return joined;
+}
 /** Refuses an index the shape check would refuse, naming a file that is not a trace file name. */
 function assertIndex(stream) {
     const index = stream.trace;
@@ -166,10 +260,22 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
         return refuse("run.json records a malformed live items index");
     if (live.items !== undefined)
         refuse("run.json holds in-progress items beside their live file");
-    if (index.bytes > maxBytes)
-        refuse(`${index.path} is indexed at ${index.bytes} bytes, more than the ${maxBytes} read`);
     const { itemsFile: _index, ...summary } = live;
     const after = liveAfter?.(index);
+    if (index.bytes > maxBytes) {
+        if (after === undefined || !cursorFits(index, after))
+            throw tooLarge(stream.id, index, maxBytes);
+        // The caller keeps the prefix it holds, read when the file was under the limit.
+        return {
+            stream: { ...stream, liveActor: { ...summary, items: [] } },
+            read: {
+                streamId: stream.id,
+                index,
+                after,
+                stopped: `Participant ${stream.id}'s items past ${after.items} were not read: ${pastLimitDetail(index, maxBytes)}. The items read before stay shown; open the file with another tool, such as jq, to read the rest.`,
+            },
+        };
+    }
     const tail = after === undefined ? undefined : await readLiveTail(read, stream, index, after);
     if (tail !== undefined)
         return {
@@ -190,6 +296,15 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
         read: { streamId: stream.id, index },
     };
 }
+/**
+ * Whether `after` can be a prefix of the file `index` describes: some bytes, no more items or bytes
+ * than the index, and at its end in both counts or in neither. Whether it ends on a line end is
+ * checked only when the tail is read.
+ */
+const cursorFits = (index, after) => after.bytes > 0 &&
+    after.items <= index.items &&
+    after.bytes <= index.bytes &&
+    (after.items === index.items) === (after.bytes === index.bytes);
 /**
  * The items of the live file `index` describes past `after`, and the bytes they were read from;
  * undefined when the cursor does not fit the index or the file's lines, so the caller reads the
@@ -197,10 +312,7 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
  * LiveFileUnreadableError, as a whole read does.
  */
 async function readLiveTail(read, stream, index, after) {
-    if (after.bytes === 0 ||
-        after.items > index.items ||
-        after.bytes > index.bytes ||
-        (after.items === index.items) !== (after.bytes === index.bytes))
+    if (!cursorFits(index, after))
         return undefined;
     if (after.bytes === index.bytes)
         return { items: [], bytes: Buffer.alloc(0) };
@@ -220,6 +332,8 @@ async function readStreamTrace(read, stream, maxBytes, liveAfter) {
     let joined = stream;
     if (stream.trace !== undefined) {
         assertIndex(stream);
+        if (stream.trace.bytes > maxBytes)
+            throw tooLarge(stream.id, stream.trace, maxBytes);
         const file = await read(stream.trace.path, maxBytes);
         if ("refused" in file)
             throw new StreamTraceRefusedError(stream.id, file.refused);
@@ -236,22 +350,37 @@ async function readStreamTrace(read, stream, maxBytes, liveAfter) {
  * stream without an index is returned as it is (a v1 stream, or one with no actor). An indexed
  * stream's file must have a trace file name (isStreamTracePath); it is read under `maxBytes` and
  * checked against the index's byte count, sha256, item count and screenshot count, and any
- * difference throws StreamTraceRefusedError. The rules that need the whole bundle (an unindexed v2
+ * difference throws StreamTraceRefusedError. An index that records more than `maxBytes` throws
+ * before the file is read. The rules that need the whole bundle (an unindexed v2
  * actor, two participants indexing one file) are loadStreamTraces'.
  */
 export async function loadStreamTrace(runPaths, stream, maxBytes = RUN_ARTIFACT_MAX_BYTES) {
     return (await readStreamTrace(containedReader(runPaths), stream, maxBytes)).stream;
 }
+/**
+ * What each version's writer never puts in run.json, so a run.json of that version that holds it
+ * did not come from the writer. From v2 the writer indexes every actor on every write, mid-run
+ * flushes included, and the final write replaces `liveActor`. From v3 a running participant's
+ * items are in a live file (humanish.live-actor.v2). From v4 the per-request lists are only in
+ * the trace file. A run.json of v1, or of no version this table names, is read as v1 is.
+ */
+const WRITER_RULES = new Map([
+    [RUN_BUNDLE_V2_SCHEMA, { liveFiles: false, listsOut: false }],
+    [RUN_BUNDLE_V3_SCHEMA, { liveFiles: true, listsOut: false }],
+    [RUN_BUNDLE_SCHEMA, { liveFiles: true, listsOut: true }],
+]);
+/**
+ * Whether a run.json of `schema` holds the per-request lists (REQUEST_LISTS) the writer kept in
+ * it: v1 to v3, and a schema WRITER_RULES does not name, which is read as v1. From v4 they are
+ * only in the trace file, so a running participant's `liveActor` holds none.
+ */
+export const keepsRequestListsInRunJson = (schema) => WRITER_RULES.get(schema)?.listsOut !== true;
 /**
  * Why a stream of this bundle cannot be read, before any file is. A trace file belongs to one
  * participant, so every stream indexing a path another stream indexes, compared as a
- * case-insensitive file system compares them, is refused. In v2 the writer
- * indexes every actor on every write, mid-run flushes included, so a v2 actor without an index lost
- * its trace file, and inline items never come from the writer. A run still writing carries its
- * participants' items so far as `liveActor`: inline in v2 (humanish.live-actor.v1), in a live file
- * from v3 (humanish.live-actor.v2), so a v3 run.json with inline live items did not come from the
- * writer. A run.json whose outcome says the run finished never carries `liveActor`, since the
- * final write replaces it.
+ * case-insensitive file system compares them, is refused in every version. The other rules are
+ * WRITER_RULES': a v2 actor without an index lost its trace file, and a run.json whose outcome says
+ * the run finished never carries `liveActor`.
  */
 function bundleRefusal(bundle, stream, owners) {
     const shared = isRecord(stream.trace)
@@ -259,16 +388,23 @@ function bundleRefusal(bundle, stream, owners) {
         : undefined;
     if (shared !== undefined && shared.length > 1)
         return `run.json indexes ${String(stream.trace.path)} for participants ${shared.join(", ")} (paths that differ only in case name one file on some file systems), and a trace file belongs to one participant`;
-    if (bundle.schema !== RUN_BUNDLE_SCHEMA && bundle.schema !== RUN_BUNDLE_V2_SCHEMA)
+    const rules = WRITER_RULES.get(String(bundle.schema));
+    if (rules === undefined)
         return undefined;
+    const version = String(bundle.schema).replace("humanish.run-bundle.", "");
     if (stream.actor !== undefined && stream.trace === undefined)
         return "run.json holds its actor and names no trace file";
     if (stream.liveActor !== undefined && bundle.outcome?.state === "finished")
         return "run.json records a finished run and still holds in-progress items";
-    if (bundle.schema === RUN_BUNDLE_SCHEMA &&
-        stream.liveActor !== undefined &&
-        isInlineLiveActor(stream.liveActor))
-        return "run.json v3 holds in-progress items inline, which the writer keeps in a live file";
+    if (rules.liveFiles && stream.liveActor !== undefined && isInlineLiveActor(stream.liveActor))
+        return `run.json ${version} holds in-progress items inline, which the writer keeps in a live file`;
+    if (rules.listsOut)
+        for (const field of ["actor", "liveActor"]) {
+            const trace = stream[field];
+            const list = isRecord(trace) ? heldRequestList(trace) : undefined;
+            if (list !== undefined)
+                return `run.json ${version} holds ${list} in its ${field}, which the writer keeps only in the trace file`;
+        }
     return undefined;
 }
 /**
@@ -282,7 +418,9 @@ function bundleRefusal(bundle, stream, owners) {
  * `liveAfter` names, for a live file's index, the prefix the caller holds already (the Observer
  * feed's cursor). The loader then reads and joins only the items past it, checked by liveItemsAfter
  * without the indexed sha256, and `live` records the cursor; a cursor past the index or off the
- * file's lines gets the whole prefix, checked as always.
+ * file's lines gets the whole prefix, checked as always. A live file whose index records more than
+ * `maxBytes` is not read: for a cursor that fits the index the stream gets no items past it and
+ * `live` records `stopped`, and without one the stream is refused.
  *
  * A live file that cannot be read may have been removed by the writer after `bundle` was read: it
  * removes a superseded generation once run.json names the next one, and every live file once the
@@ -348,13 +486,16 @@ async function loadEveryStream(read, bundle, maxBytes, liveAfter) {
 }
 /**
  * A loaded bundle as a reader that shows a run presents it. A refused stream keeps run.json's
- * summary, shows none of the items run.json or a file supplied for it (its actor's items, its
- * in-progress items, its screenshot entries), and carries `traceUnavailable` with the reason; a
- * warn event on its timeline says the same.
+ * summary, shows none of the items or per-request lists run.json or a file supplied for it (its
+ * actor's items and lists, its in-progress items, its screenshot entries), and carries
+ * `traceUnavailable` with the reason; a warn event on its timeline says the same. A reader that
+ * shows the run then never prices or checks rows the loader refused. A live file the loader
+ * stopped reading (LiveItemsRead's `stopped`) gives its stream a `live-items.not-read` warn event.
  */
 export function displayedTraces(loaded) {
     const reasons = new Map(loaded.refused.map((error) => [error.streamId, error.message]));
-    if (reasons.size === 0)
+    const stopped = (loaded.live ?? []).filter((read) => read.stopped !== undefined);
+    if (reasons.size === 0 && stopped.length === 0)
         return loaded.bundle;
     const streams = loaded.bundle.streams.map((stream) => {
         const reason = reasons.get(stream.id);
@@ -363,7 +504,7 @@ export function displayedTraces(loaded) {
         const { liveActor: _live, trace: _index, actor, ...rest } = stream;
         return {
             ...rest,
-            ...(actor === undefined ? {} : { actor: { ...actor, items: [] } }),
+            ...(actor === undefined ? {} : { actor: { ...withoutRequestLists(actor), items: [] } }),
             artifacts: stream.artifacts.filter((artifact) => !isScreenshot(artifact)),
             traceUnavailable: reason,
         };
@@ -378,7 +519,19 @@ export function displayedTraces(loaded) {
         message: reasons.get(stream.id),
         streamId: stream.id,
     }));
-    return { ...loaded.bundle, streams, events: [...loaded.bundle.events, ...events] };
+    const notRead = stopped.map((read) => ({
+        id: `event-live-items-not-read-${read.streamId}`,
+        at: loaded.bundle.streams.find((stream) => stream.id === read.streamId)?.updatedAt ?? "",
+        level: "warn",
+        type: "live-items.not-read",
+        message: read.stopped,
+        streamId: read.streamId,
+    }));
+    return {
+        ...loaded.bundle,
+        streams,
+        events: [...loaded.bundle.events, ...events, ...notRead],
+    };
 }
 /** The bundle with every stream loaded; the first refusal throws. */
 export async function loadRunTraces(source, bundle, maxBytes) {

package/dist/run/streams.d.ts

@@ -289,7 +289,10 @@ export interface RunStream {
      * completionReason, or completedAt, and this shape cannot claim them. Present only on
      * `inProgress` bundles; the final write replaces it with the real `actor` and never
      * carries it. A v3 run.json holds `humanish.live-actor.v2` with `itemsFile` in place of `items`;
-     * the trace loader (src/run/stream-trace.ts) reads the file and puts the items back.
+     * the trace loader (src/run/stream-trace.ts) reads the file and puts the items back. A v4
+     * run.json's live actor also leaves out `tokenUsage.turns` and `providerRequests`, which are
+     * written only in the trace when the participant finishes, and carries the `estimatedCost` the
+     * run writer priced from those rows.
      */
     liveActor?: {
         schema: "humanish.live-actor.v1" | "humanish.live-actor.v2";

package/dist/study/bundle-estimate.js

@@ -4,11 +4,14 @@
 // RUN_ARTIFACT_MAX_BYTES, and the public-safety scan visits at most runEntryLimit(participants)
 // files and folders.
 //
-// observer/index.html carries every participant's items gzipped, so with busy participants it can
-// pass verify's 32 MiB before run.json passes analysis's 16 MiB: at these rates, 17 participants
-// working 8 hours. observer-data.json carries the same per-request lists as run.json and was within
-// 7 % of its size on every live run measured, so it passes 32 MiB only after run.json passes
-// 16 MiB, and the estimate does not check it.
+// observer/index.html carries every participant's items gzipped, so with busy participants it
+// passes verify's 32 MiB long before run.json passes analysis's 16 MiB: at these rates, 20
+// participants working 8 hours. From run bundle v4 run.json grows by participant, not by model
+// request: each participant's per-request lists are only in its trace. run.json can still pass
+// 16 MiB, since a study's mission is not capped and each participant's stream copies it.
+// observer-data.json leaves the lists out too and was 0.94 to 1.12 of run.json's size on the live
+// runs measured, so it passes 32 MiB only after run.json passes 16 MiB, and the estimate does not
+// check it.
 import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
 import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { formatDuration } from "../run/projection.js";
@@ -20,19 +23,16 @@ import { runEntryLimit } from "../verify/scan-limit.js";
 // own files. Pace, session length and screenshots: the live computer-use runs kept on the
 // maintainer's machine. A trace's rate a turn on the public site/public/runs/lobby-0927 run
 // (8 participants, 20 to 78 turns) was 1,579 bytes plus 91 for the page, under the live fit.
+// The run.json and page data rates were measured again on those runs written as v4.
 const RATES = Object.freeze({
     /** run.json bytes for the run itself: its header, study, review and cost. Live fit: 4,381. */
     runBytes: 4_400,
     /**
-     * run.json bytes for each participant before its turns: its stream, actor summary and closing
-     * report request. Live fit: 16,239, plus one request.
+     * run.json bytes for each participant: its stream, actor summary and closing report request.
+     * Live fit on v3: 16,239. Written as v4, the kept runs of one participant held 20,571 to 23,160
+     * bytes and those of two 30,647 to 38,948, beside 20,900 and 37,400 at these rates.
      */
     participantBytes: 16_500,
-    /**
-     * run.json bytes a model turn adds: the request's entries in `tokenUsage.turns` and
-     * `conversation.requests`. Live: 30,623 bytes over 137 requests, 223.5 each.
-     */
-    turnRunBytes: 225,
     /** A trace file's bytes before its turns: the actor summary. Live fit: 5,378. */
     participantTraceBytes: 5_400,
     /**
@@ -63,10 +63,10 @@ const RATES = Object.freeze({
     /** observer/index.html's app before any run data: 1,199,831 bytes on the dry runs. */
     observerAppBytes: 1_200_000,
     /**
-     * The page's compact copy of observer-data.json, as a share of run.json: 0.64 to 0.81 whole on
-     * the live runs, 0.49 for a participant's part, and 0.42 for the per-request entries.
+     * The page's compact copy of observer-data.json, as a share of run.json: 0.71 to 0.84 on the
+     * live runs written as v4, where neither carries the per-request lists.
      */
-    observerPageDataShare: 0.5,
+    observerPageDataShare: 0.85,
     /**
      * The page's gzipped base64 items, as a share of all the traces' bytes: 0.087 to 0.114 on the
      * live runs of two participants, 0.097 for the busiest participant alone (about 475 bytes a
@@ -124,7 +124,7 @@ export function estimateBundle(participants, sessionMs) {
         largestTrace = Math.max(largestTrace, trace);
     }
     const count = participants.length;
-    const runFileBytes = RATES.runBytes + count * RATES.participantBytes + turns * RATES.turnRunBytes;
+    const runFileBytes = RATES.runBytes + count * RATES.participantBytes;
     const screenshots = count + turns + frames;
     const observerPageBytes = Math.round(RATES.observerAppBytes +
         RATES.observerPageDataShare * runFileBytes +
@@ -204,7 +204,7 @@ export function bundleLimitReason(estimate) {
         : `${changes.slice(0, -1).join(", ")}, or ${changes.at(-1)}`;
     return [
         ...passed,
-        `The estimate counts ${counted.join(" and ")}, at a model turn every ${formatDuration(RATES.secondsPerTurn * 1000)} that adds about ${RATES.turnRunBytes} bytes to run.json and up to ${(RATES.turnTraceBytes / 1000).toFixed(1)} KB to the participant's trace.`,
+        `The estimate counts ${counted.join(" and ")}, at a model turn every ${formatDuration(RATES.secondsPerTurn * 1000)} that adds up to ${(RATES.turnTraceBytes / 1000).toFixed(1)} KB to the participant's trace.`,
         "The run goes ahead.",
         `To stay under ${passed.length === 1 ? "the limit" : "the limits"}, ${advice}.`,
     ].join(" ");

package/dist/verify/costs.d.ts

@@ -24,7 +24,11 @@ export declare function contradictsAccountBilling(streams: readonly {
  * a null estimate, or a participant without estimatedCost is fine. A non-null figure must carry its
  * ratesAsOf date + source; a number total must equal round6(sum of only the non-null lines) and a
  * null line may never be coerced to 0. A null estimate must be declared (a reason + null
- * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. Account-billed participants
- * also have their execution profile and provider request receipts checked here.
+ * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. A running participant's
+ * estimate is checked the same way. Account-billed participants also have their execution profile
+ * and provider request receipts checked here. From v4 a running participant's receipts are written
+ * only in its trace when it finishes, so its live actor holds none. The receipts of a stream in
+ * `refused` (its trace the loader refused) are not checked: from v4 they are only in that trace,
+ * and verify reports the refusal.
  */
-export declare function costAndReceiptFindings(bundle: RunBundle): string[];
+export declare function costAndReceiptFindings(bundle: RunBundle, refused: ReadonlySet<string>): string[];

package/dist/verify/costs.js

@@ -2,6 +2,7 @@
 // totals match their known lines, and account-billed participants never acquire a price.
 import { validActorExecutionProfile, validActorProviderRequests } from "../actors/contract.js";
 import { round6 } from "../run/pricing.js";
+import { keepsRequestListsInRunJson } from "../run/stream-trace.js";
 /** Account-billed participants must never acquire a price through an aggregate or ambiguous model line. */
 export function contradictsAccountBilling(streams, cost) {
     const account = (stream) => (stream.liveActor?.executionProfile ?? stream.actor?.executionProfile)?.billing ===
@@ -28,18 +29,23 @@ export function contradictsAccountBilling(streams, cost) {
  * a null estimate, or a participant without estimatedCost is fine. A non-null figure must carry its
  * ratesAsOf date + source; a number total must equal round6(sum of only the non-null lines) and a
  * null line may never be coerced to 0. A null estimate must be declared (a reason + null
- * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. Account-billed participants
- * also have their execution profile and provider request receipts checked here.
+ * ratesAsOf), mirroring the terminal no-spend proof's null-discipline. A running participant's
+ * estimate is checked the same way. Account-billed participants also have their execution profile
+ * and provider request receipts checked here. From v4 a running participant's receipts are written
+ * only in its trace when it finishes, so its live actor holds none. The receipts of a stream in
+ * `refused` (its trace the loader refused) are not checked: from v4 they are only in that trace,
+ * and verify reports the refusal.
  */
-export function costAndReceiptFindings(bundle) {
+export function costAndReceiptFindings(bundle, refused) {
     const findings = [];
     if (contradictsAccountBilling(bundle.streams, bundle.cost))
         findings.push("Run cost lines contradict account billing identity");
     findings.push(...costSummaryFindings(bundle.cost));
+    const liveReceipts = keepsRequestListsInRunJson(bundle.schema);
     for (const stream of bundle.streams) {
-        for (const actor of [stream.actor, stream.liveActor]) {
-            findings.push(...executionReceiptFindings(actor));
-        }
+        const loaded = !refused.has(stream.id);
+        findings.push(...executionReceiptFindings(stream.actor, loaded));
+        findings.push(...executionReceiptFindings(stream.liveActor, liveReceipts && loaded));
         findings.push(...participantEstimateFindings(stream));
     }
     return findings;
@@ -81,14 +87,17 @@ function costSummaryFindings(cost) {
     }
     return findings;
 }
-/** An account-billed participant's execution profile and provider request receipts. */
-function executionReceiptFindings(actor) {
+/**
+ * An account-billed participant's execution profile and, when `receipts` says the trace holds
+ * them, its provider request receipts.
+ */
+function executionReceiptFindings(actor, receipts) {
     const findings = [];
     if (actor?.executionProfile === undefined)
         return findings;
     if (!validActorExecutionProfile(actor.executionProfile))
         findings.push("Invalid actor execution profile");
-    if (!validActorProviderRequests(actor.providerRequests))
+    if (receipts && !validActorProviderRequests(actor.providerRequests))
         findings.push("Invalid account participant request receipts");
     if (actor.historyTurnsOmitted !== undefined &&
         (!Number.isSafeInteger(actor.historyTurnsOmitted) || actor.historyTurnsOmitted < 0))
@@ -99,14 +108,20 @@ function executionReceiptFindings(actor) {
         findings.push("Account participant dollars must remain unknown");
     return findings;
 }
+/** The labeling of a participant's estimate: its finished actor's, and its live actor's while it runs. */
 function participantEstimateFindings(stream) {
+    const participantLabel = stream.laneId ?? stream.id;
+    return [
+        ...estimateFindings(stream.actor?.estimatedCost, participantLabel, "actor"),
+        ...estimateFindings(stream.liveActor?.estimatedCost, participantLabel, "live actor"),
+    ];
+}
+function estimateFindings(estimate, participantLabel, field) {
     const findings = [];
-    const estimate = stream.actor?.estimatedCost;
     if (!estimate)
         return findings;
-    const participantLabel = stream.laneId ?? stream.id;
     if (estimate.schema !== "humanish.actor-estimated-cost.v1") {
-        findings.push(`participant ${participantLabel} actor estimatedCost schema is ${String(estimate.schema)}, expected humanish.actor-estimated-cost.v1`);
+        findings.push(`participant ${participantLabel} ${field} estimatedCost schema is ${String(estimate.schema)}, expected humanish.actor-estimated-cost.v1`);
     }
     if (estimate.estimatedCostUsd !== null) {
         if (typeof estimate.ratesAsOf !== "string" || estimate.ratesAsOf.length === 0) {

package/dist/verify/verify.js

@@ -5,7 +5,7 @@ import { analysisSharingProblems } from "../analysis/sharing.js";
 import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
 import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
-import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, } from "../run/bundle.js";
+import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, RUN_BUNDLE_V3_SCHEMA, } from "../run/bundle.js";
 import { ContainedReadRefusedError, refusalText } from "../run/contained-output.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
 import { loadStreamTraces } from "../run/stream-trace.js";
@@ -139,7 +139,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
                 ? [`missing local evidence artifacts: ${missingEvidenceArtifacts.join(", ")}`]
                 : []),
     ]));
-    checks.push(...(await evidenceChecks(runPaths, bundle, cleanupRead)));
+    checks.push(...(await evidenceChecks(runPaths, bundle, cleanupRead, traces.refusedStreams)));
     const recordingOk = checks.every((check) => check.ok);
     if (derivedPublicSafetyFindings.length > 0)
         checks.push({
@@ -225,12 +225,13 @@ function evidenceArtifactsCheck(shaped, problems) {
 }
 /**
  * run.json with each stream's trace loaded, one file at a time, and the refusal of each trace that
- * does not match its index. A run.json that fails the shape guard is returned as it is.
+ * does not match its index, with the ids of those streams. A run.json that fails the shape guard
+ * is returned as it is.
  */
 async function loadTraces(runPaths, stored) {
     const scanned = { sensitive: [], opaque: [] };
     if (!isRunBundle(stored))
-        return { bundle: stored, refusedTraces: [], ...scanned, pages: [] };
+        return { bundle: stored, refusedTraces: [], refusedStreams: new Set(), ...scanned, pages: [] };
     // Each trace is source evidence: scanned by the bytes it was joined from, apart from the
     // directory walk and any path exemption the walk makes.
     const { bundle, refused } = await loadStreamTraces(runPaths, stored, {
@@ -243,6 +244,7 @@ async function loadTraces(runPaths, stored) {
     return {
         bundle,
         refusedTraces: refused.map((error) => error.message),
+        refusedStreams: new Set(refused.map((error) => error.streamId)),
         ...scanned,
         pages: pageFindings(bundle),
     };
@@ -312,7 +314,7 @@ function bundlePresenceChecks(bundleRead, review) {
                 ? `run.json declares ${String(schema)}`
                 : record === undefined
                     ? "no readable run.json, so no schema"
-                    : `run.json declares ${typeof schema === "string" ? schema : "no schema"}; verify reads ${RUN_BUNDLE_SCHEMA}, ${RUN_BUNDLE_V2_SCHEMA} and ${RUN_BUNDLE_V1_SCHEMA}`,
+                    : `run.json declares ${typeof schema === "string" ? schema : "no schema"}; verify reads ${RUN_BUNDLE_SCHEMA}, ${RUN_BUNDLE_V3_SCHEMA}, ${RUN_BUNDLE_V2_SCHEMA} and ${RUN_BUNDLE_V1_SCHEMA}`,
         },
         {
             name: "run bundle shape",
@@ -378,8 +380,12 @@ function findingsCheck(name, findings, okMessage, failLabel) {
  * check has no findings and stays ok; the shape check is the failure.
  */
 const SHAPE_UNCHECKED = "not checked, because run.json failed the shape check";
-/** The bundle-content checks, in report order. A bundle that fails its shape guard has no findings. */
-async function evidenceChecks(runPaths, bundle, cleanupRead) {
+/**
+ * The bundle-content checks, in report order. A bundle that fails its shape guard has no findings.
+ * `refusedStreams` names the streams whose traces the loader refused, which the evidence-artifacts
+ * check reports.
+ */
+async function evidenceChecks(runPaths, bundle, cleanupRead, refusedStreams) {
     const cleanupJson = runJsonValue(cleanupRead);
     const valid = isRunBundle(bundle) ? bundle : null;
     const pass = (message) => (valid ? message : SHAPE_UNCHECKED);
@@ -409,7 +415,7 @@ async function evidenceChecks(runPaths, bundle, cleanupRead) {
         // Absence passes (fail-open on display); a claimed dollar figure without its ratesAsOf date +
         // source, or a total that does not match its known lines, fails. Magnitude is never inspected:
         // a correctly-labeled huge estimate still passes.
-        findingsCheck("cost estimate labeling", valid ? costAndReceiptFindings(valid) : [], pass("every cost estimate carries its ratesAsOf date and source and the total matches its lines, or the run claims no cost"), "cost labeling findings"),
+        findingsCheck("cost estimate labeling", valid ? costAndReceiptFindings(valid, refusedStreams) : [], pass("every cost estimate carries its ratesAsOf date and source and the total matches its lines, or the run claims no cost"), "cost labeling findings"),
     ];
     return checks;
 }