humanish 0.128.0 → 0.129.0

package/CHANGELOG.md

@@ -8,6 +8,19 @@ The Unreleased section holds the full notes for the next version until it is tag
 
 ## Unreleased
 
+## 0.129.0: Analysis reads long runs past 100,000 items; traces past 32 MiB get their own advice; shared-world skips counted apart (2026-10-13)
+
+humanish 0.129.0 fixes three things long studies reach. Analysis no longer refuses a run by how
+many events, trace items or screenshot frames it holds; it still reads each file only up to 16
+MiB. A trace or live file past 32 MiB, the most the trace loader reads, is refused with advice
+that fits, a running participant whose live file passes 32 MiB keeps the items the Observer page
+already shows, and the Observer server reads run.json under that limit. Shared-world runs count a
+participant skipped before its session apart from those that used the app, and no longer count a
+skip as overlap. This is a minor release because a shared-world `skippedReason` is now a sentence
+where it was `handoff-timeout` or `host-ended-before-handoff`.
+
+[Release notes](https://github.com/danielgwilson/humanish/releases/tag/v0.129.0)
+
 ## 0.128.0: Run bundle v4 keeps per-request lists in trace files; the study budget is checked before each request (2026-10-13)
 
 humanish 0.128.0 keeps run.json small in long studies. Run bundles are now

package/dist/analysis/evidence.js

@@ -35,7 +35,6 @@ function parseSource(prepared, bytes) {
         !Array.isArray(value.streams) ||
         value.streams.length > EVIDENCE_LIMITS.participants ||
         !Array.isArray(value.events) ||
-        value.events.length > 100000 ||
         (value.commsReceiving !== undefined && !isCommsReceivingEvidence(value.commsReceiving)))
         throw new Error("ANALYSIS_SOURCE_INVALID");
     const ids = new Set();
@@ -79,10 +78,8 @@ async function readSource(prepared, bytes, traceBytes) {
     return loaded.bundle;
 }
 function validateTraceItems(actor) {
-    if (actor !== undefined &&
-        (!isRecord(actor) || !Array.isArray(actor.items) || actor.items.length > 100000)) {
+    if (actor !== undefined && (!isRecord(actor) || !Array.isArray(actor.items)))
         throw new Error("ANALYSIS_SOURCE_INVALID");
-    }
     const eventIds = new Set();
     for (const item of isRecord(actor) ? actor.items : []) {
         if (!isRecord(item) ||

package/dist/analysis/validation.js

@@ -150,7 +150,7 @@ const analysisEvidenceSchema = z
     quoteEligible: z.boolean(),
     at: timestamp.nullable(),
     elapsedMs: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
-    frame: z.number().int().min(0).max(100000).nullable(),
+    frame: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
     capture: z
         .object({
         eventId: sourceId,

package/dist/cli/commands/study-format.js

@@ -138,7 +138,8 @@ export function formatConcurrentSharedWorldStudyHuman(result) {
                     ? "Participants used the app at the same time (observed in this run only)."
                     : "Participants were not observed using the app at the same time.",
             ]),
-        ...result.roles.map((participant) => `${participantCaption({ id: participant.id, personaId: participant.persona })}: ${participantStatus(participant.status)}${participant.ok ? "" : ", not ok"}`),
+        // A skipped participant's line ends on the reason the run recorded, as on computer use.
+        ...result.roles.map((participant) => `${participantCaption({ id: participant.id, personaId: participant.persona })}: ${participantStatus(participant.status)}${participant.ok ? "" : ", not ok"}${participant.skippedReason === undefined ? "" : ` · ${participant.skippedReason}`}`),
         ...(result.subjectSandbox
             ? [
                 `subject sandbox: ${sandboxName(result.subjectSandbox)} killed=${result.subjectSandbox.killed ? "yes" : "no"}`,

package/dist/observer/feed-cursors.d.ts

@@ -9,6 +9,8 @@ import type { ObserverItems } from "./participant-items.js";
 export declare function parseFeedCursors(after: string | null): ReadonlyMap<string, LiveItemsCursor>;
 /**
  * `items` with each live file's cursor on the entry of the stream it was joined into, and
- * `liveAfter`, the page's cursor, where the entry's `liveActor` holds only the items past it.
+ * `liveAfter`, the page's cursor, where the entry's `liveActor` holds only the items past it. A
+ * live file the loader stopped reading (LiveItemsRead's `stopped`) keeps the page's cursor as its
+ * own, so the page holds its items and sends that cursor again.
  */
 export declare function withFeedCursors(items: ObserverItems, live: readonly LiveItemsRead[]): ObserverItems;

package/dist/observer/feed-cursors.js

@@ -43,7 +43,9 @@ function cursorText(path, position) {
 }
 /**
  * `items` with each live file's cursor on the entry of the stream it was joined into, and
- * `liveAfter`, the page's cursor, where the entry's `liveActor` holds only the items past it.
+ * `liveAfter`, the page's cursor, where the entry's `liveActor` holds only the items past it. A
+ * live file the loader stopped reading (LiveItemsRead's `stopped`) keeps the page's cursor as its
+ * own, so the page holds its items and sends that cursor again.
  */
 export function withFeedCursors(items, live) {
     const streams = Object.assign(Object.create(null), items.streams);
@@ -51,9 +53,10 @@ export function withFeedCursors(items, live) {
         const entry = Object.hasOwn(streams, read.streamId) ? streams[read.streamId] : undefined;
         if (entry === undefined || !Array.isArray(entry.liveActor))
             continue;
+        const end = read.stopped === undefined ? read.index : read.after;
         streams[read.streamId] = {
             ...entry,
-            live: cursorText(read.index.path, read.index),
+            live: cursorText(read.index.path, end),
             ...(read.after === undefined ? {} : { liveAfter: cursorText(read.index.path, read.after) }),
         };
     }

package/dist/observer/run-routes.js

@@ -10,6 +10,7 @@ import { listRuns } from "../run/stored-runs.js";
 import { readAnalysisAccounting } from "../run/costs.js";
 import { bindExistingRunArtifactPaths, isPathInside, isSafeRunIdSegment, } from "../run/paths.js";
 import { isRunOutcome } from "../run/bundle-shape.js";
+import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { displayedTraces, loadStreamTraces, } from "../run/stream-trace.js";
 import { isNodeError, isRecord } from "../run/type-guards.js";
 import { MAX_NOTE_FILE_BYTES, readRunNotes, RUN_NOTES_DIR, } from "../run/note-files.js";
@@ -150,10 +151,17 @@ export async function serveRunPath(runRoot, relativePath, response, runtimeStrea
         writeResponse(response, 404, "Not found", "text/plain; charset=utf-8");
         return;
     }
+    // run.json is read under the limit every other reader of it uses, by name as through the feed.
+    const runJson = cleanedRelativePath === "run.json";
     try {
-        const body = await readContainedFile(runRoot, filePath, notePath ? { maxBytes: MAX_NOTE_FILE_BYTES } : {});
+        const body = await readContainedFile(runRoot, filePath, notePath
+            ? { maxBytes: MAX_NOTE_FILE_BYTES }
+            : runJson
+                ? { maxBytes: RUN_ARTIFACT_MAX_BYTES }
+                : {});
         if (!body) {
-            writeResponse(response, 404, "Not found", "text/plain; charset=utf-8");
+            const tooLarge = runJson ? await pastReadLimit(runRoot, "run.json") : undefined;
+            writeResponse(response, 404, tooLarge === undefined ? "Not found" : `Not found: ${tooLarge}`, "text/plain; charset=utf-8");
             return;
         }
         response.writeHead(200, {
@@ -198,12 +206,15 @@ async function readObserverData(runRoot, runtimeStreamUrls = []) {
  * fallback. The saved observer-data.json is read only while the run has no run.json at all, or in
  * safe serving, where only its admitted bytes can be read. Otherwise a run.json that is there and
  * cannot be read, parsed or used as a bundle (which a browser poll can meet mid-write) gives the
- * reason, a 404 the poller retries, never the saved projection.
+ * reason, a 404 the poller retries, never the saved projection. Both files are read under
+ * RUN_ARTIFACT_MAX_BYTES, as every other reader of a run file reads them.
  */
 async function observerDataOrReason(runRoot, runtimeStreamUrls, cursors) {
     const record = await readLocalRunStatus(runRoot);
     const runJson = path.join(runRoot.physicalPath, "run.json");
-    const bundleBytes = await readContainedFile(runRoot, runJson).catch(() => null);
+    const bundleBytes = await readContainedFile(runRoot, runJson, {
+        maxBytes: RUN_ARTIFACT_MAX_BYTES,
+    }).catch(() => null);
     const absent = bundleBytes === null &&
         (await lstat(runJson).then(() => false, (error) => isNodeError(error) && error.code === "ENOENT"));
     // A root admitted for safe serving checks every read against the identity and digest admitted
@@ -214,7 +225,10 @@ async function observerDataOrReason(runRoot, runtimeStreamUrls, cursors) {
         return "unavailable" in saved ? saved : { data: saved, live: [] };
     }
     if (bundleBytes === null)
-        return { unavailable: "run.json is there but could not be read: it is a link or changed." };
+        return {
+            unavailable: (await pastReadLimit(runRoot, "run.json")) ??
+                "run.json is there but could not be read: it is a link or changed.",
+        };
     let stored;
     try {
         const parsed = JSON.parse(bundleBytes.toString("utf8"));
@@ -237,12 +251,31 @@ async function observerDataOrReason(runRoot, runtimeStreamUrls, cursors) {
         return { unavailable: "run.json could not be shown as a run." };
     }
 }
+/**
+ * Why run.json or a saved observer-data.json was not read, when the file at `relativePath` passes
+ * the root's checks and is larger than RUN_ARTIFACT_MAX_BYTES, the most the server reads of either;
+ * otherwise undefined. The size comes from the opened file, so no link or file outside the run
+ * folder is measured.
+ */
+async function pastReadLimit(runRoot, relativePath) {
+    const opened = await openContainedFile(runRoot, path.join(runRoot.physicalPath, relativePath));
+    if (opened === null)
+        return undefined;
+    await opened.handle.close().catch(() => undefined);
+    return opened.size > RUN_ARTIFACT_MAX_BYTES
+        ? `${relativePath} is larger than ${RUN_ARTIFACT_MAX_BYTES} bytes, the most humanish reads of it.`
+        : undefined;
+}
 /** The saved observer-data.json of a run that has written no run.json yet. */
 async function savedObserverData(runRoot, record, runtimeStreamUrls) {
     try {
-        const observerBytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, "observer", "observer-data.json"));
-        if (!observerBytes)
+        const observerBytes = await readContainedFile(runRoot, path.join(runRoot.physicalPath, "observer", "observer-data.json"), { maxBytes: RUN_ARTIFACT_MAX_BYTES });
+        if (!observerBytes) {
+            const tooLarge = await pastReadLimit(runRoot, "observer/observer-data.json");
+            if (tooLarge !== undefined)
+                return { unavailable: tooLarge };
             throw new Error("observer-data.json unavailable");
+        }
         const saved = observerDataFromSaved(JSON.parse(observerBytes.toString("utf8")));
         if (saved === null)
             throw new Error("observer-data.json holds no participant's items");

package/dist/routes/computer-use/fanout-bundle.js

@@ -4,7 +4,7 @@ import { actorEnding } from "../../actors/stop-cause.js";
 import { cuaGoalSource } from "../../actors/goal-source.js";
 import { redactText } from "../../evidence/redaction.js";
 import { REVIEW_SCHEMA, bundleArtifacts, bundleHead, } from "../../run/bundle.js";
-import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, gapsListClause, withCuaReviewProvenance, } from "../../run/outcomes.js";
+import { aggregateTaskFunnels, formatParticipantOutcomes, formatRunTaskFunnel, gapsListClause, skippedSentence, withCuaReviewProvenance, } from "../../run/outcomes.js";
 import { providerResourcesForOutcome, publicSafeAppUrlLabel } from "./bundle-parts.js";
 import { subjectName } from "../../run/subject-name.js";
 import { participantFeedbackCandidates } from "./participant-feedback.js";
@@ -63,12 +63,9 @@ function fanoutSummary(args, facts) {
     // A run where every participant was skipped has no one to describe in this sentence.
     if (tookPart > 0)
         sentences.push(`${plural(tookPart, "participant")} took part, ${tookPart === 1 ? "in its own copy" : "each in their own copy"} of the app: ${outcomes}${gaps}.`);
-    // The gaps are pointed at once: here only when the sentence before did not.
-    const why = gaps === "" ? "; the gaps say why" : "";
-    if (facts.skipped === 1)
-        sentences.push(`1 participant was skipped before its session started${why}.`);
-    if (facts.skipped > 1)
-        sentences.push(`${facts.skipped} participants were skipped before their sessions started${why}.`);
+    const skipped = skippedSentence(facts.skipped, gaps === "");
+    if (skipped !== "")
+        sentences.push(skipped);
     return `${host}${rerun}${sentences.join(" ")}${tasks}`;
 }
 /**

package/dist/routes/shared-world/bundle-records.js

@@ -67,7 +67,12 @@ function sharedWorldSimulation(ctx, spec, index, view) {
         mode: "browser-sim",
         progress: inProgress ? 35 : 100,
         currentStep: view.reason,
-        summary: participantSummary(name, { name: "the shared app" }, { trace: session?.trace, sessionError: outcome?.sessionError, inProgress }),
+        summary: participantSummary(name, { name: "the shared app" }, {
+            trace: session?.trace,
+            skippedReason: outcome?.skippedReason,
+            sessionError: outcome?.sessionError,
+            inProgress,
+        }),
         startedAt: args.run.createdAt,
         updatedAt: args.run.createdAt,
         ...(args.plan.arrivals.declared

package/dist/routes/shared-world/bundle.d.ts

@@ -7,6 +7,14 @@ export declare function maxSimultaneousWindows(windows: Array<{
     startedAt: number;
     endedAt: number;
 }>): number;
+/**
+ * The windows of the participants that used the app, for overlap and the live-at-once count. A
+ * participant the run skipped before its session started never used it, though its window sits
+ * inside another participant's session. run.json's laneWindows keep that window: verify expects
+ * one per declared participant, and reads overlap from them only on a pass, which a run with a
+ * skipped participant cannot reach.
+ */
+export declare function usedAppWindows(results: readonly ActorRunResult[]): ActorRunResult[];
 /**
  * The judgment for a shared-world bundle's inputs: how each participant ended, plus what the run
  * observed about its world: overlap, a state change under overlap on the provisioned plane, and

package/dist/routes/shared-world/bundle.js

@@ -16,7 +16,7 @@ import { hostOriginDigest } from "./provenance.js";
 import { participantEvent, participantIds } from "../../run/participant-records.js";
 import { sharedWorldParticipantRecords } from "./bundle-records.js";
 import { CONCURRENT_ATTRIBUTION_LIMITS, EXTERNAL_PUBLIC_ATTRIBUTION_LIMITS, } from "./types.js";
-import { gapsListClause } from "../../run/outcomes.js";
+import { gapsListClause, skippedSentence } from "../../run/outcomes.js";
 import { plural } from "../../run/text.js";
 import { describeArrivals } from "../../study/arrivals.js";
 /** Max windows live at the same instant (sweep over start/end points). The simultaneity
@@ -38,6 +38,16 @@ export function maxSimultaneousWindows(windows) {
     }
     return max;
 }
+/**
+ * The windows of the participants that used the app, for overlap and the live-at-once count. A
+ * participant the run skipped before its session started never used it, though its window sits
+ * inside another participant's session. run.json's laneWindows keep that window: verify expects
+ * one per declared participant, and reads overlap from them only on a pass, which a run with a
+ * skipped participant cannot reach.
+ */
+export function usedAppWindows(results) {
+    return results.filter((result) => result.outcome.skippedReason === undefined);
+}
 /**
  * The judgment for a shared-world bundle's inputs: how each participant ended, plus what the run
  * observed about its world: overlap, a state change under overlap on the provisioned plane, and
@@ -52,11 +62,7 @@ export function judgeSharedWorldRun(args) {
         expected: args.actorSpecs.length,
         participants: args.actorResults.map((result) => participantFactsOf(result.outcome)),
         world: {
-            // The same windows and state series the bundle writes, read by verify's pass gate too.
-            ...concurrencyFacts(args.actorSpecs.map((_spec, index) => ({
-                startedAt: args.actorResults[index]?.startedAt ?? 0,
-                endedAt: args.actorResults[index]?.endedAt ?? 0,
-            })), external ? undefined : args.stateSnapshots),
+            ...concurrencyFacts(usedAppWindows(args.actorResults), external ? undefined : args.stateSnapshots),
             ...(external ? { lobbyConvergence: args.lobbyConvergenceDigest !== undefined } : {}),
         },
     });
@@ -68,8 +74,10 @@ export function actorRunPassed(result) {
  * The run's summary in plain sentences: who took part, how many reached the goal, and what the
  * world showed. A participant reached the goal when its session passed the judge's checks and
  * ended at the goal, so a productive `budget_reached` session does not count even when the lobby
- * converged. Each participant's ending stays in `sharedWorld.outcomes`, and the plane, topology
- * and attribution limits stay in the bundle's events and `sharedWorld` block.
+ * converged. A participant the run skipped, such as a follower stopped at the handoff, never used
+ * the app, so it is counted in a sentence of its own. Each participant's ending stays in
+ * `sharedWorld.outcomes`, and the plane, topology and attribution limits stay in the bundle's
+ * events and `sharedWorld` block.
  */
 function sharedWorldSummary(args, facts) {
     const count = args.actorSpecs.length;
@@ -79,16 +87,20 @@ function sharedWorldSummary(args, facts) {
         const served = facts.external ? ", as it is deployed" : ", served from a sandbox";
         return `Dry run: ${people} would use ${app} at the same time${served}. No sandboxes were launched and $0 was spent.`;
     }
+    // The live summary is written once, before any participant starts, so it names the plan.
     if (facts.inProgress) {
-        return `${people} ${count === 1 ? "is" : "are"} using ${app} at the same time. The run is still going, so nothing here is final.`;
+        return `${people} ${count === 1 ? "is planned, in" : "are planned, all in"} ${app}. The run is still going, so nothing here is final.`;
     }
     const passed = facts.outcomes.filter((outcome) => outcome.ok);
     const reached = passed.filter((outcome) => outcome.completionReason === "goal_satisfied").length;
-    const together = facts.overlaps ? " at the same time" : ", but never at the same time";
+    const skipped = args.actorResults.filter((result) => result.outcome.skippedReason !== undefined).length;
+    const tookPart = count - skipped;
+    const together = tookPart === 1 ? "" : facts.overlaps ? " at the same time" : ", but never at the same time";
     // A participant who did not pass has a gap line; one who passed but stopped short has none.
+    const gaps = gapsListClause(tookPart - passed.length, tookPart);
     const rest = [
         passed.length > reached ? `; ${passed.length - reached} ended without reaching it` : "",
-        gapsListClause(count - passed.length, count),
+        gaps,
     ].join("");
     const world = facts.external
         ? args.lobbyConvergenceDigest
@@ -97,7 +109,15 @@ function sharedWorldSummary(args, facts) {
         : facts.deltas === 0
             ? "The app's shared state did not change during the run."
             : `The app's shared state changed ${plural(facts.deltas, "time")} during the run.`;
-    return `${people} used ${app}${together}. ${reached} of ${count} reached the goal${rest}. ${world}`;
+    return [
+        tookPart > 0
+            ? `${plural(tookPart, "participant")} used ${app}${together}. ${reached} of ${tookPart} reached the goal${rest}.`
+            : "",
+        skippedSentence(skipped, gaps === ""),
+        world,
+    ]
+        .filter((sentence) => sentence !== "")
+        .join(" ");
 }
 /** The run's first two events: its creation and the shared plane's provenance. */
 function planeEvents(args, external) {
@@ -261,7 +281,7 @@ function concurrencyReview(args, external, inProgress, evidence, events, nextEve
     // The count that matters is how many participants were live at once, which can be fewer than exist:
     // a 6-participant run capped at 3 must never read as 6-wide concurrency.
     const capForReport = plan.concurrency;
-    const maxLive = maxSimultaneousWindows(windows);
+    const maxLive = maxSimultaneousWindows(usedAppWindows(args.actorResults));
     events.push({
         id: nextEventId("concurrency"),
         at: createdAt,

package/dist/routes/shared-world/participant-specs.d.ts

@@ -12,7 +12,8 @@ export declare function resolveActorEntryUrl(baseUrl: string, entry: string | un
  *  follower joins through the real UI (a direct /lobby/CODE visit does not auto-join a non-member). */
 export declare function withLobbyCodeMission(spec: DesktopParticipantRun, code: string): DesktopParticipantRun;
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
- * keep the actual reason rather than turning every upstream failure into a timeout. */
+ * keep the actual reason rather than turning every upstream failure into a timeout. The skip
+ * reason is a sentence in the form the computer-use skips use, since run lines and gaps print it. */
 export declare function makeBlockedFollowerOutcome(spec: DesktopParticipantRun, reason: string, timedOut: boolean): ParticipantRunOutcome;
 /**
  * A live run publishes an in-progress bundle before its participants start, whether or not an

package/dist/routes/shared-world/participant-specs.js

@@ -63,7 +63,8 @@ export function withLobbyCodeMission(spec, code) {
     };
 }
 /** A follower blocked by an expired deadline or an ended host. It never opened a browser;
- * keep the actual reason rather than turning every upstream failure into a timeout. */
+ * keep the actual reason rather than turning every upstream failure into a timeout. The skip
+ * reason is a sentence in the form the computer-use skips use, since run lines and gaps print it. */
 export function makeBlockedFollowerOutcome(spec, reason, timedOut) {
     return {
         spec,
@@ -77,7 +78,9 @@ export function makeBlockedFollowerOutcome(spec, reason, timedOut) {
         noEngagement: true,
         selfReportedBlocker: false,
         harnessError: false,
-        skippedReason: timedOut ? "handoff-timeout" : "host-ended-before-handoff",
+        skippedReason: timedOut
+            ? "skipped: the host did not reach a lobby within the handoff deadline; no desktop was created"
+            : "skipped: the host ended before it reached a lobby; no desktop was created",
     };
 }
 /**

package/dist/routes/shared-world/result.js

@@ -8,7 +8,7 @@ import { validatePreparedRunArtifactPaths } from "../../run/paths.js";
 import { participantExecutionFailures, participantFactsOf, } from "../computer-use/participant-facts.js";
 import { participantCapWarning } from "../computer-use/participant-model.js";
 import { resolveSubjectState } from "../computer-use/subject-projection.js";
-import { actorRunPassed, buildConcurrentSharedWorldBundle, judgeSharedWorldRun, maxSimultaneousWindows, } from "./bundle.js";
+import { actorRunPassed, buildConcurrentSharedWorldBundle, judgeSharedWorldRun, maxSimultaneousWindows, usedAppWindows, } from "./bundle.js";
 import { planeStateOf } from "./plan.js";
 import { buildSubjectProvenance, hostOriginDigest } from "./provenance.js";
 import {} from "./types.js";
@@ -47,9 +47,16 @@ function concurrentParticipantResults(actorSpecs, actorResults, dryRun) {
         }
         const session = result.outcome.session;
         const thisOk = participantOk(result);
+        const { skippedReason } = result.outcome;
+        // The same judged record run.json writes, so the run line and the bundle name one status.
+        const record = judgeParticipantRecords([participantFactsOf(result.outcome)], {
+            sessionLabel: "Participant",
+            missingSessionMessage: "Actor did not produce a terminal session.",
+        }).participants[0];
         return {
             ...base,
-            status: session ? session.status : "failed",
+            status: record.status,
+            ...(skippedReason === undefined ? {} : { skippedReason }),
             ok: thisOk,
             window: { startedAt: result.startedAt, endedAt: result.endedAt },
             ...(session
@@ -70,10 +77,7 @@ function concurrentParticipantResults(actorSpecs, actorResults, dryRun) {
                 : {
                     error: {
                         code: "HUMANISH_SHARED_WORLD_FAILED",
-                        message: judgeParticipantRecords([participantFactsOf(result.outcome)], {
-                            sessionLabel: "Participant",
-                            missingSessionMessage: "Actor did not produce a terminal session.",
-                        }).participants[0].notPassedMessage,
+                        message: record.notPassedMessage,
                     },
                 }),
         };
@@ -306,7 +310,9 @@ export async function finishConcurrentRun(ctx, live, results, plane) {
             ? {}
             : { subjectSandbox: { sandboxId: subjectSandboxId, killed: subjectKilled } }),
         ...(dryRun ? {} : { overlapProven }),
-        ...(dryRun ? {} : { maxSimultaneousLanes: maxSimultaneousWindows(actorResults) }),
+        ...(dryRun
+            ? {}
+            : { maxSimultaneousLanes: maxSimultaneousWindows(usedAppWindows(actorResults)) }),
         subject,
         roles: participantResults,
         observer,

package/dist/routes/shared-world/types.d.ts

@@ -94,6 +94,8 @@ export interface ConcurrentSharedWorldParticipantResult {
         sandboxIdDigest?: string;
         killed: boolean;
     };
+    /** Set when the run skipped the participant before its session started (status `blocked`). */
+    skippedReason?: string;
     error?: {
         code: ConcurrentSharedWorldStudyErrorCode;
         message: string;

package/dist/run/outcomes.d.ts

@@ -53,6 +53,13 @@ interface SummarySession {
 export declare function participantSummary(name: string, app: SummaryApp, session: SummarySession): string;
 /** "; the gaps list the other 2", or "all 3" when nobody passed. Empty when the gaps list nobody. */
 export declare function gapsListClause(listed: number, total: number): string;
+/**
+ * The sentence that counts the participants a run skipped before their sessions started, or ""
+ * when it skipped none. A skipped participant never used the app, so a summary counts it here and
+ * leaves it out of the sentence about those that took part. `pointAtGaps` is false when that
+ * sentence already points at the gaps.
+ */
+export declare function skippedSentence(skipped: number, pointAtGaps: boolean): string;
 /** One line a stakeholder can read, with the denominator attached to every number. */
 export declare function formatParticipantOutcomes(outcomes: ParticipantOutcomes, terminalCauses?: readonly ParticipantOutcomeDetail[]): string;
 /** Presentation details tolerate optional legacy actor payloads without changing their tallies. */

package/dist/run/outcomes.js

@@ -206,6 +206,20 @@ export function gapsListClause(listed, total) {
         return `; the gaps list the other ${listed}`;
     return total === 1 ? "; the gaps say why" : `; the gaps list all ${total}`;
 }
+/**
+ * The sentence that counts the participants a run skipped before their sessions started, or ""
+ * when it skipped none. A skipped participant never used the app, so a summary counts it here and
+ * leaves it out of the sentence about those that took part. `pointAtGaps` is false when that
+ * sentence already points at the gaps.
+ */
+export function skippedSentence(skipped, pointAtGaps) {
+    const why = pointAtGaps ? "; the gaps say why" : "";
+    if (skipped === 1)
+        return `1 participant was skipped before its session started${why}.`;
+    if (skipped > 1)
+        return `${skipped} participants were skipped before their sessions started${why}.`;
+    return "";
+}
 /** One line a stakeholder can read, with the denominator attached to every number. */
 export function formatParticipantOutcomes(outcomes, terminalCauses = []) {
     if (outcomes.total === 0)

package/dist/run/stream-trace.d.ts

@@ -2,10 +2,13 @@ import { type RunBundle } from "./bundle.js";
 import { type PreparedOutputRoot } from "./contained-output.js";
 import { type LiveItemsCursor } from "./live-items.js";
 import type { LiveItemsIndex, RunStream } from "./streams.js";
-/** A trace that does not match its index, or cannot be read. The message names the stream. */
+/**
+ * A trace that does not match its index, or cannot be read. The message names the stream, and ends
+ * with `advice`: by default, restore the run folder from a copy.
+ */
 export declare class StreamTraceRefusedError extends Error {
     readonly streamId: string;
-    constructor(streamId: string, detail: string);
+    constructor(streamId: string, detail: string, advice?: string);
 }
 /** `trace` without the per-request lists; every other field as it is. */
 export declare function withoutRequestLists<T extends object>(trace: T): T;
@@ -39,13 +42,22 @@ export type TraceFileReader = (relativePath: string, maxBytes: number, length?:
 }>;
 /**
  * A live file the loader joined into stream `streamId`: the index it read the items by, and the
- * cursor it read past when the stream holds only the items after one.
+ * cursor it read past when the stream holds only the items after one. A read with `stopped` has
+ * an index that records more than the loader reads of one file, so it read nothing and joined no
+ * items past `after`, which it always has; `stopped` is the warning a reader that shows the run
+ * gives.
  */
-export interface LiveItemsRead {
+export type LiveItemsRead = {
     streamId: string;
     index: LiveItemsIndex;
     after?: LiveItemsCursor;
-}
+    stopped?: undefined;
+} | {
+    streamId: string;
+    index: LiveItemsIndex;
+    after: LiveItemsCursor;
+    stopped: string;
+};
 /** For a live file's index, the prefix of that file the caller holds already, if any. */
 type LiveAfter = (index: LiveItemsIndex) => LiveItemsCursor | undefined;
 /**
@@ -53,7 +65,8 @@ type LiveAfter = (index: LiveItemsIndex) => LiveItemsCursor | undefined;
  * stream without an index is returned as it is (a v1 stream, or one with no actor). An indexed
  * stream's file must have a trace file name (isStreamTracePath); it is read under `maxBytes` and
  * checked against the index's byte count, sha256, item count and screenshot count, and any
- * difference throws StreamTraceRefusedError. The rules that need the whole bundle (an unindexed v2
+ * difference throws StreamTraceRefusedError. An index that records more than `maxBytes` throws
+ * before the file is read. The rules that need the whole bundle (an unindexed v2
  * actor, two participants indexing one file) are loadStreamTraces'.
  */
 export declare function loadStreamTrace(runPaths: PreparedOutputRoot, stream: RunStream, maxBytes?: number): Promise<RunStream>;
@@ -80,7 +93,9 @@ interface LoadedTraces {
  * `liveAfter` names, for a live file's index, the prefix the caller holds already (the Observer
  * feed's cursor). The loader then reads and joins only the items past it, checked by liveItemsAfter
  * without the indexed sha256, and `live` records the cursor; a cursor past the index or off the
- * file's lines gets the whole prefix, checked as always.
+ * file's lines gets the whole prefix, checked as always. A live file whose index records more than
+ * `maxBytes` is not read: for a cursor that fits the index the stream gets no items past it and
+ * `live` records `stopped`, and without one the stream is refused.
  *
  * A live file that cannot be read may have been removed by the writer after `bundle` was read: it
  * removes a superseded generation once run.json names the next one, and every live file once the
@@ -97,11 +112,13 @@ export declare function loadStreamTraces(source: PreparedOutputRoot | TraceFileR
  * summary, shows none of the items or per-request lists run.json or a file supplied for it (its
  * actor's items and lists, its in-progress items, its screenshot entries), and carries
  * `traceUnavailable` with the reason; a warn event on its timeline says the same. A reader that
- * shows the run then never prices or checks rows the loader refused.
+ * shows the run then never prices or checks rows the loader refused. A live file the loader
+ * stopped reading (LiveItemsRead's `stopped`) gives its stream a `live-items.not-read` warn event.
  */
 export declare function displayedTraces(loaded: {
     bundle: RunBundle;
     refused: readonly StreamTraceRefusedError[];
+    live?: readonly LiveItemsRead[];
 }): RunBundle;
 /** The bundle with every stream loaded; the first refusal throws. */
 export declare function loadRunTraces(source: PreparedOutputRoot | TraceFileReader, bundle: RunBundle, maxBytes?: number): Promise<RunBundle>;

package/dist/run/stream-trace.js

@@ -13,15 +13,25 @@ import { isLiveItemsIndex, LIVE_ACTOR_SCHEMA, LIVE_ACTOR_V1_SCHEMA, liveItemsAft
 import { estimateActorCostForExecution } from "./pricing.js";
 import { isRunStreamArtifact, isStreamTraceIndex, isStreamTracePath } from "./stream-shape.js";
 import { isRecord } from "./type-guards.js";
-/** A trace that does not match its index, or cannot be read. The message names the stream. */
+/**
+ * A trace that does not match its index, or cannot be read. The message names the stream, and ends
+ * with `advice`: by default, restore the run folder from a copy.
+ */
 export class StreamTraceRefusedError extends Error {
     streamId;
-    constructor(streamId, detail) {
-        super(`Participant ${streamId}'s trace was not read: ${detail}. A trace file must stay as the run wrote it; restore the run folder from a copy.`);
+    constructor(streamId, detail, advice = "A trace file must stay as the run wrote it; restore the run folder from a copy.") {
+        super(`Participant ${streamId}'s trace was not read: ${detail}. ${advice}`);
         this.streamId = streamId;
         this.name = "StreamTraceRefusedError";
     }
 }
+/** Why the loader reads no trace or live file whose index records more than `maxBytes`. */
+const pastLimitDetail = (index, maxBytes) => `run.json records ${index.path} at ${index.bytes} bytes, more than the ${maxBytes} bytes humanish reads of one file`;
+/**
+ * The refusal of a trace or live file whose index records more than `maxBytes`. The loader reads
+ * no file past the limit, so a copy of the file is refused too.
+ */
+const tooLarge = (streamId, index, maxBytes) => new StreamTraceRefusedError(streamId, pastLimitDetail(index, maxBytes), "Restoring a copy does not help; open the file with another tool, such as jq, to read its items.");
 const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 const isScreenshot = (artifact) => artifact.kind === "screenshot";
 /**
@@ -250,10 +260,22 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
         return refuse("run.json records a malformed live items index");
     if (live.items !== undefined)
         refuse("run.json holds in-progress items beside their live file");
-    if (index.bytes > maxBytes)
-        refuse(`${index.path} is indexed at ${index.bytes} bytes, more than the ${maxBytes} read`);
     const { itemsFile: _index, ...summary } = live;
     const after = liveAfter?.(index);
+    if (index.bytes > maxBytes) {
+        if (after === undefined || !cursorFits(index, after))
+            throw tooLarge(stream.id, index, maxBytes);
+        // The caller keeps the prefix it holds, read when the file was under the limit.
+        return {
+            stream: { ...stream, liveActor: { ...summary, items: [] } },
+            read: {
+                streamId: stream.id,
+                index,
+                after,
+                stopped: `Participant ${stream.id}'s items past ${after.items} were not read: ${pastLimitDetail(index, maxBytes)}. The items read before stay shown; open the file with another tool, such as jq, to read the rest.`,
+            },
+        };
+    }
     const tail = after === undefined ? undefined : await readLiveTail(read, stream, index, after);
     if (tail !== undefined)
         return {
@@ -274,6 +296,15 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
         read: { streamId: stream.id, index },
     };
 }
+/**
+ * Whether `after` can be a prefix of the file `index` describes: some bytes, no more items or bytes
+ * than the index, and at its end in both counts or in neither. Whether it ends on a line end is
+ * checked only when the tail is read.
+ */
+const cursorFits = (index, after) => after.bytes > 0 &&
+    after.items <= index.items &&
+    after.bytes <= index.bytes &&
+    (after.items === index.items) === (after.bytes === index.bytes);
 /**
  * The items of the live file `index` describes past `after`, and the bytes they were read from;
  * undefined when the cursor does not fit the index or the file's lines, so the caller reads the
@@ -281,10 +312,7 @@ async function readLiveItems(read, stream, maxBytes, liveAfter) {
  * LiveFileUnreadableError, as a whole read does.
  */
 async function readLiveTail(read, stream, index, after) {
-    if (after.bytes === 0 ||
-        after.items > index.items ||
-        after.bytes > index.bytes ||
-        (after.items === index.items) !== (after.bytes === index.bytes))
+    if (!cursorFits(index, after))
         return undefined;
     if (after.bytes === index.bytes)
         return { items: [], bytes: Buffer.alloc(0) };
@@ -304,6 +332,8 @@ async function readStreamTrace(read, stream, maxBytes, liveAfter) {
     let joined = stream;
     if (stream.trace !== undefined) {
         assertIndex(stream);
+        if (stream.trace.bytes > maxBytes)
+            throw tooLarge(stream.id, stream.trace, maxBytes);
         const file = await read(stream.trace.path, maxBytes);
         if ("refused" in file)
             throw new StreamTraceRefusedError(stream.id, file.refused);
@@ -320,7 +350,8 @@ async function readStreamTrace(read, stream, maxBytes, liveAfter) {
  * stream without an index is returned as it is (a v1 stream, or one with no actor). An indexed
  * stream's file must have a trace file name (isStreamTracePath); it is read under `maxBytes` and
  * checked against the index's byte count, sha256, item count and screenshot count, and any
- * difference throws StreamTraceRefusedError. The rules that need the whole bundle (an unindexed v2
+ * difference throws StreamTraceRefusedError. An index that records more than `maxBytes` throws
+ * before the file is read. The rules that need the whole bundle (an unindexed v2
  * actor, two participants indexing one file) are loadStreamTraces'.
  */
 export async function loadStreamTrace(runPaths, stream, maxBytes = RUN_ARTIFACT_MAX_BYTES) {
@@ -387,7 +418,9 @@ function bundleRefusal(bundle, stream, owners) {
  * `liveAfter` names, for a live file's index, the prefix the caller holds already (the Observer
  * feed's cursor). The loader then reads and joins only the items past it, checked by liveItemsAfter
  * without the indexed sha256, and `live` records the cursor; a cursor past the index or off the
- * file's lines gets the whole prefix, checked as always.
+ * file's lines gets the whole prefix, checked as always. A live file whose index records more than
+ * `maxBytes` is not read: for a cursor that fits the index the stream gets no items past it and
+ * `live` records `stopped`, and without one the stream is refused.
  *
  * A live file that cannot be read may have been removed by the writer after `bundle` was read: it
  * removes a superseded generation once run.json names the next one, and every live file once the
@@ -456,11 +489,13 @@ async function loadEveryStream(read, bundle, maxBytes, liveAfter) {
  * summary, shows none of the items or per-request lists run.json or a file supplied for it (its
  * actor's items and lists, its in-progress items, its screenshot entries), and carries
  * `traceUnavailable` with the reason; a warn event on its timeline says the same. A reader that
- * shows the run then never prices or checks rows the loader refused.
+ * shows the run then never prices or checks rows the loader refused. A live file the loader
+ * stopped reading (LiveItemsRead's `stopped`) gives its stream a `live-items.not-read` warn event.
  */
 export function displayedTraces(loaded) {
     const reasons = new Map(loaded.refused.map((error) => [error.streamId, error.message]));
-    if (reasons.size === 0)
+    const stopped = (loaded.live ?? []).filter((read) => read.stopped !== undefined);
+    if (reasons.size === 0 && stopped.length === 0)
         return loaded.bundle;
     const streams = loaded.bundle.streams.map((stream) => {
         const reason = reasons.get(stream.id);
@@ -484,7 +519,19 @@ export function displayedTraces(loaded) {
         message: reasons.get(stream.id),
         streamId: stream.id,
     }));
-    return { ...loaded.bundle, streams, events: [...loaded.bundle.events, ...events] };
+    const notRead = stopped.map((read) => ({
+        id: `event-live-items-not-read-${read.streamId}`,
+        at: loaded.bundle.streams.find((stream) => stream.id === read.streamId)?.updatedAt ?? "",
+        level: "warn",
+        type: "live-items.not-read",
+        message: read.stopped,
+        streamId: read.streamId,
+    }));
+    return {
+        ...loaded.bundle,
+        streams,
+        events: [...loaded.bundle.events, ...events, ...notRead],
+    };
 }
 /** The bundle with every stream loaded; the first refusal throws. */
 export async function loadRunTraces(source, bundle, maxBytes) {

package/docs/architecture/observer.md

@@ -97,6 +97,19 @@ A page that cannot join a body sends no cursors with its next poll. Static
 operator path. Agents and CI should use `humanish watch --json --no-open` for
 the same fresh evidence without browser open or a long-running process.
 
+The feed reads no live file whose index passes the 32 MiB read limit
+(`RUN_ARTIFACT_MAX_BYTES`); a request for the file by its path still gets the whole file. A page
+that sends a cursor for it keeps the items it holds: the
+server answers with no items past the cursor, gives the page's cursor back as `live`, and adds a
+`live-items.not-read` warning to the participant's timeline, so later polls send the same cursor
+and get the same answer. A poll that sends no cursor for that file gets the participant's trace
+as unavailable, with the file's size and the limit, and the page drops any items it held. Such a
+poll comes from a page opened after the file passed the limit or after the writer started a new
+generation, from the poll after a body the page could not join, and from a page whose cursors
+pass 8,000 characters (`MAX_AFTER_CHARS` in `observer/lib/live.ts`), which sends none. When the
+run finishes, a trace file past the limit is refused too, and every page shows that trace as
+unavailable.
+
 ### Reopening a run
 
 The TUI's **Open in Observer** action opens an HTTP view of the selected run's saved

package/docs/contracts/run-bundle.md

@@ -54,7 +54,12 @@ file that does not match its index. Inside humanish, readers load a stream throu
 `loadStreamTrace(runPaths, stream)`. A v1 stream returns as it is.
 An indexed stream's file is read under the 32 MiB per-file limit (analysis uses its 16 MiB
 source limit for each trace) and refused unless its size, sha256, item count and screenshot count
-match the index. A trace file belongs to one participant: every stream whose index names a file
+match the index. A trace or live file whose index records more than the limit is refused before it
+is read, and the refusal says the file is larger than humanish reads of one file and that
+restoring a copy does not help. A trace file whose index is under the limit and whose bytes are
+over it changed after the run wrote it, and its refusal says to restore the run folder from a copy.
+A live file may hold bytes past its index while the writer appends; the loader reads only the
+indexed bytes. A trace file belongs to one participant: every stream whose index names a file
 another stream's index names, compared without case as a case-insensitive file system compares
 names, is refused before any file is read. The writer claims names the same way. In a v2 run.json every `actor`
 must have an index: an actor with no index, with
@@ -133,8 +138,9 @@ Readers that show a run (the Observer server, run detail and the TUI, the review
 provenance) load traces through the same loader and rules. A participant whose trace the loader
 refused shows none of the items run.json or a file supplied for it: its stream carries
 `traceUnavailable` with the reason, its Observer timeline a `trace.unavailable` warning, and its
-run-detail entry `evidenceUnavailable`. The Observer server reads the saved observer-data.json
-only while a run has no run.json at all; a run.json that is there and cannot be read, parsed or
+run-detail entry `evidenceUnavailable`. The Observer server reads run.json, and the saved
+observer-data.json, under the same 32 MiB limit; past it the server answers 404 with a reason
+naming the limit. It reads the saved observer-data.json only while a run has no run.json at all; a run.json that is there and cannot be read, parsed or
 used as a bundle answers 404 with the reason, never the saved projection. In safe serving
 (`observe --all --safe`) every read is checked against the files admitted with the run's
 share_ready verification, so a run.json changed after admission is refused and the admitted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.128.0",
+  "version": "0.129.0",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",