humanish 0.133.1 → 0.135.0

package/dist/study/bundle-estimate.js

@@ -16,13 +16,14 @@
 // observer-data.json leaves the lists out too and was 0.94 to 1.12 of run.json's size on the live
 // runs measured, so it passes 32 MiB only after run.json passes 16 MiB, and the estimate does not
 // check it.
-// The Observer page and the Observer server join every participant's items in one string before
-// gzip. A bundle export renders the Observer page, so it fails there too once --max-bytes is
-// raised past its 25 MiB default, which refuses such a run first. Writing run.json joins none: the
-// sandbox id scrub (publicSandboxView) works one participant at a time. V8's longest string is
-// 536,870,888 characters on Node 24. A trace file's bytes are at least the characters of its
-// items as compact JSON, so the estimate compares the traces' bytes and may warn a little early.
-import { constants } from "node:buffer";
+// A page past 32 MiB grades the run local_only. humanish export then needs --local-only, and a
+// bundle export fails even with it, since its copy must verify as share_ready.
+// The Observer feed, verify, analysis and the run.json writer each hold one participant's items in
+// a string at a time. The page holds all of them gzipped in base64, about 0.18 characters for each
+// trace byte, so it reaches V8's longest string, 536,870,888 characters, near 3 GB of traces.
+// humanish observe on 25 participants with 30 MiB traces wrote a 138 MiB page at a peak of
+// 3.8 GiB, so memory may run out first. Neither limit was measured past that run, and the estimate
+// checks neither.
 import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
 import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { formatDuration } from "../run/projection.js";
@@ -32,9 +33,15 @@ import { runEntryLimit } from "../verify/scan-limit.js";
 // the 0.125.0 smoke test and the 2026-10-12 live checks, 10 participants with 1 to 28 turns and 137
 // model requests. Dry: runs of 1, 2, 24 and 100 participants, for the Observer app and the run's
 // own files. Pace, session length and screenshots: the live computer-use runs kept on the
-// maintainer's machine. A trace's rate a turn on the public site/public/runs/lobby-0927 run
-// (8 participants, 20 to 78 turns) was 1,579 bytes plus 91 for the page, under the live fit.
-// The run.json and page data rates were measured again on those runs written as v4.
+// maintainer's machine. The run.json and page data rates were measured again on those runs
+// written as v4.
+// The trace rates were measured on trace files written indented. The writer now writes them as
+// compact JSON, so each trace rate below is the indented figure divided by 1.36, the ratio of
+// indented to compact bytes over 236 kept computer-use traces (1.17 to 1.49 each), and the page's
+// share of the traces is multiplied by it. A trace's rate a turn on the public
+// site/public/runs/lobby-0927 run (8 participants, 20 to 78 turns) was 1,579 bytes plus 91 for the
+// page indented, under the live fit. Its participant of 78 turns writes a trace of 149,637 bytes
+// indented and 107,897 compact.
 const RATES = Object.freeze({
     /** run.json bytes for the run itself: its header, study, review and cost. Live fit: 4,381. */
     runBytes: 4_400,
@@ -44,21 +51,21 @@ const RATES = Object.freeze({
      * bytes and those of two 30,647 to 38,948, beside 20,900 and 37,400 at these rates.
      */
     participantBytes: 16_500,
-    /** A trace file's bytes before its turns: the actor summary. Live fit: 5,378. */
-    participantTraceBytes: 5_400,
+    /** A trace file's bytes before its turns: the actor summary. Live fit: 5,378 indented. */
+    participantTraceBytes: 4_000,
     /**
      * Trace bytes a model turn adds: its items, its screenshot entry and its request's usage, plus 91
-     * for the `page` each screenshot item now carries. Live fit: 1,965 a turn. Participants with 4
-     * or more turns ranged from 1,140 to 4,532; the busiest made 311 items in 15 turns, most of them
-     * UI actions. Analysis refuses the whole run when one trace passes its limit, so each trace is
-     * counted at the busiest participant's rate.
+     * for the `page` each screenshot item now carries, all indented. Live fit: 1,965 a turn.
+     * Participants with 4 or more turns ranged from 1,140 to 4,532; the busiest made 311 items in 15
+     * turns, most of them UI actions. Analysis refuses the whole run when one trace passes its limit,
+     * so each trace is counted at the busiest participant's rate, 4,700 indented.
      */
-    turnTraceBytes: 4_700,
+    turnTraceBytes: 3_500,
     /**
      * Trace bytes a dwell frame adds: 395 for its item and entry on the kept runs with dwell frames,
-     * plus 91 for the page.
+     * plus 91 for the page, indented.
      */
-    frameTraceBytes: 500,
+    frameTraceBytes: 400,
     /**
      * Seconds between model turns: the median of the 27 of 185 kept live participants that worked 5
      * minutes or more was 10.4.
@@ -83,12 +90,12 @@ const RATES = Object.freeze({
      */
     observerPageDataShare: 0.85,
     /**
-     * The page's gzipped base64 items, as a share of all the traces' bytes: 0.087 to 0.114 on the
-     * live runs of two participants, 0.097 for the busiest participant alone (about 475 bytes a
-     * turn), 0.142 to 0.184 on runs of one participant and 4 to 11 turns, and 0.095 on 0.124.0's
-     * synthetic 8-hour run.
+     * The page's gzipped base64 items, as a share of all the traces' bytes indented: 0.087 to 0.114
+     * on the live runs of two participants, 0.097 for the busiest participant alone (about 475 bytes
+     * a turn), 0.142 to 0.184 on runs of one participant and 4 to 11 turns, and 0.095 on 0.124.0's
+     * synthetic 8-hour run. The estimate counted 0.12 of indented traces.
      */
-    observerPageItemsShare: 0.12,
+    observerPageItemsShare: 0.16,
     /** A desktop screenshot: the median of 3,990 kept live PNG frames was 107,895 bytes. */
     screenshotBytes: 110_000,
     /**
@@ -163,7 +170,6 @@ export function estimateBundle(participants, sessionMs) {
     return {
         runFileBytes,
         largestTraceBytes: largestTrace,
-        tracesBytes: traces,
         observerPageBytes,
         // observer-data.json is about run.json's size.
         totalBytes: observerPageBytes + screenshots * RATES.screenshotBytes + traces + 2 * runFileBytes,
@@ -186,7 +192,6 @@ export function estimateBundle(participants, sessionMs) {
 export function bundleLimitReason(estimate) {
     const runFile = estimate.runFileBytes > EVIDENCE_LIMITS.sourceBytes;
     const page = estimate.observerPageBytes > RUN_ARTIFACT_MAX_BYTES;
-    const joined = estimate.tracesBytes > constants.MAX_STRING_LENGTH;
     const entries = estimate.entries > estimate.entryLimit;
     const passed = [
         ...(runFile
@@ -201,12 +206,7 @@ export function bundleLimitReason(estimate) {
             : []),
         ...(page
             ? [
-                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file.`,
-            ]
-            : []),
-        ...(joined
-            ? [
-                `All participants' traces together may grow to about ${mib(estimate.tracesBytes)}, past the ${mib(constants.MAX_STRING_LENGTH)} that fits in one string. The Observer page puts all their items in one string, so the page would not build. A bundle export allowed past its 25 MiB default renders that page, so it would fail too.`,
+                `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file, so verify would grade the run local_only: humanish export would refuse it without --local-only, and a bundle export would fail.`,
             ]
             : []),
         ...(entries
@@ -236,7 +236,7 @@ export function bundleLimitReason(estimate) {
         ...(runFile ? ["shorten the mission (actor.mission)"] : []),
     ];
     // A trace is one participant's, so splitting the study helps only the run's own files.
-    if (runFile || page || joined || entries || changes.length === 0)
+    if (runFile || page || entries || changes.length === 0)
         changes.push("split the participants across studies");
     const advice = changes.length < 2
         ? changes.join("")

package/dist/study/config.d.ts

@@ -30,9 +30,10 @@ interface ConfigRefusal {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export declare function libraryConfigRefusal(config: StudyConfig): ConfigRefusal | undefined;
 export {};

package/dist/study/config.js

@@ -30,7 +30,7 @@ import { isLocalBrowserStudy, localBrowserDefaults, localBrowserUnsupportedReaso
 import { isRecord } from "../run/type-guards.js";
 import { compositionReason } from "./composition-rules.js";
 import { V2_SCHEMA, V2_UNSUPPORTED_MESSAGE, v2FieldMoves } from "./migrate/v2.js";
-import { parseActorFields, parseActorType, parseParticipantEntries } from "./parse/actors.js";
+import { actorModelReason, parseActorFields, parseActorType, parseParticipantEntries, } from "./parse/actors.js";
 import { parseComms, recipientParticipantId } from "./parse/comms.js";
 import { parseCaps, parseDefaults, parseExecution, parsePolicies, parseReview, } from "./parse/execution.js";
 import { ACTOR_REQUIRED, readStudyFront, routeNameReason, } from "./parse/front.js";
@@ -96,9 +96,10 @@ function routeMismatchReason(config) {
 }
 /**
  * Why runStudy refuses a config a library caller passes, or undefined: a humanish.lab.v2 config,
- * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, and one
- * whose `route` is not the route its subject and actor take, with parseStudy's message. A planner
- * reads only the v3 fields, so a budget left in `execution.caps` would otherwise run uncapped.
+ * one that still sets a StudyConfig field of humanish 0.110, one with no `actor` object, one
+ * whose `route` is not the route its subject and actor take, and one whose `actor.model` verify
+ * would flag, with parseStudy's message. A planner reads only the v3 fields, so a budget left in
+ * `execution.caps` would otherwise run uncapped, and passes the model on as written.
  */
 export function libraryConfigRefusal(config) {
     const raw = config;
@@ -114,7 +115,9 @@ export function libraryConfigRefusal(config) {
         };
     if (!isRecord(raw.actor))
         return { code: "HUMANISH_STUDY_INVALID", message: ACTOR_REQUIRED };
-    const message = routeNameReason(raw.route) ?? routeMismatchReason(config);
+    const message = routeNameReason(raw.route) ??
+        routeMismatchReason(config) ??
+        actorModelReason(raw.actor.model, "actor");
     return message === undefined ? undefined : { code: "HUMANISH_STUDY_INVALID", message };
 }
 // Each section in a fixed order, so a file with more than one error always reports the same one

package/dist/study/parse/actors.d.ts

@@ -6,6 +6,12 @@ export declare function parseActorType(entry: Record<string, unknown>, path: str
     ok: true;
     value: string;
 } | StudyParseFailure;
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export declare function actorModelReason(raw: unknown, path: string): string | undefined;
 /** An actor's keys other than `type`. */
 type ActorFields = Omit<StudyActor, "type">;
 /**

package/dist/study/parse/actors.js

@@ -51,6 +51,17 @@ function parsePersonaId(raw, path) {
     }
     return { ok: true, value: persona };
 }
+/**
+ * Why an actor's `model` is refused, or undefined. The provider is asked for the model and its trace
+ * records the name, so redacting it would ask for another model. Text verify would flag, as written
+ * or encoded, is refused instead. runStudy asks this of a config built without parseStudy too.
+ */
+export function actorModelReason(raw, path) {
+    const model = str(raw);
+    if (model === undefined || !scanEncodedText(model).sensitive)
+        return undefined;
+    return `\`${path}.model\` looks like a secret or a local path, and the run records it. Set the model id your provider lists, or leave \`${path}.model\` out to use the default.`;
+}
 /**
  * Every actor key other than `type`. The parser reads them after the participant entries, so a file
  * with errors in both reports the entry first.
@@ -65,6 +76,9 @@ export function parseActorFields(entry, path) {
     const mission = str(entry.mission);
     if (mission)
         actor.mission = mission;
+    const modelReason = actorModelReason(entry.model, path);
+    if (modelReason)
+        return invalid(modelReason);
     const model = str(entry.model);
     if (model)
         actor.model = model;

package/dist/study/parse/subject-state.js

@@ -1,7 +1,7 @@
 // The state and env channels of a served subject (clone or local-tree): `subject.envValues`,
 // the structural parse of `subject.state`, and subjectStateInvalidReason, the semantic check
 // parseStudy and the computer-use route share.
-import { containsSensitive } from "../../evidence/redaction.js";
+import { scanEncodedText } from "../../evidence/encoded-text.js";
 import { ENV_NAME_PATTERN, invalid, posInt, str, strList } from "./values.js";
 import { isRecord } from "../../run/type-guards.js";
 /**
@@ -29,9 +29,9 @@ export function parseEnvValues(raw) {
         if (value === undefined) {
             return invalid(`\`subject.envValues.${name}\` must be a string, number, or boolean.`);
         }
-        // Reuse the redaction module's own detector rather than inventing a second opinion about what
-        // a secret looks like; the two must never disagree about the same string.
-        if (containsSensitive(value)) {
+        // verify blocks a run whose files scanEncodedText reads as sensitive, so this refuses what that
+        // scan reads: a secret or local path as written, or decoded from base64 or an escape.
+        if (scanEncodedText(value).sensitive) {
             return invalid(`\`subject.envValues.${name}\` looks like a secret or a local path, and envValues are committed with the study and recorded in evidence. List the name in \`subject.env\` instead: its value then comes from your environment and is never stored.`);
         }
         envValues[name] = value;

package/dist/study/participant-assignment.js

@@ -1,9 +1,9 @@
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 /** Project only authored participant-facing fields. Never pass runtime-composed instructions:
  * they can contain inbox URLs or multiplayer grants. Pick fields explicitly so a task's hidden
  * success criteria cannot cross this evidence boundary, even from an untyped library caller. */
 export function participantAssignment(assignment, scrubKnownValues = (text) => text) {
-    const sanitize = (text) => redactText(scrubKnownValues(text));
+    const sanitize = (text) => redactEncodedText(scrubKnownValues(text));
     return {
         mission: sanitize(assignment.mission),
         ...(assignment.focus === undefined ? {} : { focus: sanitize(assignment.focus) }),

package/dist/study/persona.d.ts

@@ -37,7 +37,13 @@ export declare function parseResolvedPersona(raw: unknown, fallback: {
 }, warnings?: string[]): ResolvedPersona;
 export declare function personaToDirectives(persona: ResolvedPersona): PersonaDirectives;
 export declare function renderPersonaPromptSection(persona: ResolvedPersona): string;
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
 export declare function personaBrief(persona: ResolvedPersona, scrub?: (text: string) => string): NonNullable<ActorPersonaRef["brief"]>;
 export declare function scrubPersonaBrief(persona: ActorPersonaRef, scrub: (text: string) => string): ActorPersonaRef;
 export {};

package/dist/study/persona.js

@@ -1,3 +1,4 @@
+import { redactEncodedText } from "../evidence/encoded-text.js";
 import { digestText, redactText } from "../evidence/redaction.js";
 import { isRecord } from "../run/type-guards.js";
 export const PERSONA_BACKGROUND_MAX_BYTES = 32 * 1024;
@@ -136,8 +137,9 @@ export function personaToDirectives(persona) {
         ...(patience ? [`patience:${patience}`] : []),
         ...(skill ? [`skill:${skill}`] : []),
     ];
+    // A live participant's trace records traitsApplied as it is, and the need is free text.
     if (accessibilityNeeds)
-        traitsApplied.push(`accessibility:${accessibilityNeeds}`);
+        traitsApplied.push(`accessibility:${redactEncodedText(accessibilityNeeds)}`);
     if (persona.constraints.length)
         traitsApplied.push(`constraints:${persona.constraints.length}`);
     return {
@@ -166,9 +168,15 @@ export function renderPersonaPromptSection(persona) {
         .filter(Boolean)
         .join("\n\n");
 }
-/** Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. */
-export function personaBrief(persona, scrub = (text) => text) {
-    const original = renderPersonaPromptSection(persona), text = redactText(scrub(original));
+/**
+ * Only the authored persona section; excludes task criteria, runtime grants and inbox URLs. With
+ * `scrub`, the run's known values come out first, then keys as written or encoded. Without it, only
+ * keys as written come out. A route that learns its known values later passes this brief to
+ * scrubPersonaBrief, and an encoded key replaced here would cut a known value that holds one, so
+ * that scrub could no longer find the value whole.
+ */
+export function personaBrief(persona, scrub) {
+    const original = renderPersonaPromptSection(persona), text = scrub === undefined ? redactText(original) : redactEncodedText(scrub(original));
     return {
         compilerVersion: PERSONA_COMPILER_VERSION,
         text,
@@ -180,7 +188,7 @@ export function personaBrief(persona, scrub = (text) => text) {
 export function scrubPersonaBrief(persona, scrub) {
     if (!persona.brief)
         return persona;
-    const text = redactText(scrub(persona.brief.text));
+    const text = redactEncodedText(scrub(persona.brief.text));
     return {
         ...persona,
         brief: {

package/dist/study/plan-base.js

@@ -1,7 +1,7 @@
 // What every route planner shares: the plan fields common to all routes, the frozen residual config,
 // and the requirement and subject helpers.
 import { DEFAULT_OPENAI_CU_MODEL } from "../actors/computer-use/openai-provider.js";
-import { redactText } from "../evidence/redaction.js";
+import { redactEncodedText } from "../evidence/encoded-text.js";
 // A YAML alias can make a parsed record contain itself (an inline persona that names its own
 // anchor), and structuredClone keeps the cycle, so each object is frozen once.
 function deepFreeze(value, frozen = new WeakSet()) {
@@ -112,8 +112,9 @@ export function planBase(config, input) {
     return {
         studyId: config.id,
         // Every bundle writer takes the title from here, and review.md, run.json and the Observer show
-        // it, so a key or sandbox URL in it would make verify grade the run blocked.
-        ...(config.title === undefined ? {} : { title: redactText(config.title) }),
+        // it, so a key or sandbox URL in it, as written or encoded, would make verify grade the run
+        // blocked.
+        ...(config.title === undefined ? {} : { title: redactEncodedText(config.title) }),
         residual: residualOf(config),
         dryRun: input.dryRun,
         ...(analysis === undefined

package/dist/verify/artifacts.d.ts

@@ -22,7 +22,13 @@ export interface UnscannedArtifacts {
  * and where it stopped, each in its own sentence. Undefined when the scan read everything.
  */
 export declare function unscannedMessage(unscanned: UnscannedArtifacts): string | undefined;
-export declare function missingLocalEvidenceArtifacts(runPaths: PreparedRunArtifactPaths, bundle: RunBundle): Promise<string[]>;
+/**
+ * Why each local evidence path the bundle requires is missing or unusable. A path in
+ * `pastReadLimit` is a trace verify found larger than it reads, which verify lists as unscanned so
+ * the run grades local_only. It meets a requirement only while it is still past the limit when
+ * this check reads it, and never a screenshot or recording requirement.
+ */
+export declare function missingLocalEvidenceArtifacts(runPaths: PreparedRunArtifactPaths, bundle: RunBundle, pastReadLimit: ReadonlySet<string>): Promise<string[]>;
 /**
  * The PNG frames that actor traces register as stream screenshots, relative to the run root.
  * RAW_SCREENSHOTS grades these, so the public-safety scan does not report them as unread. Only

package/dist/verify/artifacts.js

@@ -47,7 +47,13 @@ function listed(paths) {
     const more = paths.length - MAX_LISTED_UNSCANNED;
     return `${paths.slice(0, MAX_LISTED_UNSCANNED).join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
 }
-export async function missingLocalEvidenceArtifacts(runPaths, bundle) {
+/**
+ * Why each local evidence path the bundle requires is missing or unusable. A path in
+ * `pastReadLimit` is a trace verify found larger than it reads, which verify lists as unscanned so
+ * the run grades local_only. It meets a requirement only while it is still past the limit when
+ * this check reads it, and never a screenshot or recording requirement.
+ */
+export async function missingLocalEvidenceArtifacts(runPaths, bundle, pastReadLimit) {
     const recordings = new Map(bundle.streams.flatMap((stream) => stream.recording ? [[stream.recording.path, stream.recording]] : []));
     const requiredPaths = new Map();
     const addRequiredPath = (artifactPath, options = {}) => {
@@ -110,12 +116,15 @@ export async function missingLocalEvidenceArtifacts(runPaths, bundle) {
         }
     }
     // Reads overlap, so one frame's file system calls run while another frame's PNG is checked.
-    const found = await mapWithConcurrency([...requiredPaths], EVIDENCE_READ_CONCURRENCY, ([artifactPath, requirements]) => missingArtifact(runPaths, artifactPath, requirements, recordings.get(artifactPath)));
+    const found = await mapWithConcurrency([...requiredPaths], EVIDENCE_READ_CONCURRENCY, ([artifactPath, requirements]) => missingArtifact(runPaths, artifactPath, { ...requirements, pastReadLimit: pastReadLimit.has(artifactPath) }, recordings.get(artifactPath)));
     return found.filter((entry) => entry !== null);
 }
 // Evidence files verify reads at once. Each read holds at most RUN_ARTIFACT_MAX_BYTES.
 const EVIDENCE_READ_CONCURRENCY = 8;
-/** Why one required path fails its requirements, or null when it meets them. */
+/**
+ * Why one required path fails its requirements, or null when it meets them. `pastReadLimit` says
+ * verify listed the path as a trace past the read limit, so a file still past it is present.
+ */
 async function missingArtifact(runPaths, artifactPath, requirements, recording) {
     if (recording) {
         const handle = await openContainedRegularFile(runPaths, artifactPath);
@@ -136,7 +145,9 @@ async function missingArtifact(runPaths, artifactPath, requirements, recording)
         ? await readScreenshot(runPaths, artifactPath)
         : await readSafeRunArtifact(runPaths, artifactPath);
     if (read.state === "limit")
-        return `${artifactPath} (larger than the ${RUN_ARTIFACT_MAX_BYTES} bytes verify reads)`;
+        return requirements.pastReadLimit && !requirements.screenshot
+            ? null
+            : `${artifactPath} (larger than the ${RUN_ARTIFACT_MAX_BYTES} bytes verify reads)`;
     if (read.state === "unavailable" ||
         (("size" in read ? read.size : read.bytes.length) === 0 && !requirements.allowEmpty))
         return artifactPath;

package/dist/verify/verify.js

@@ -7,9 +7,9 @@ import { containsSensitiveJson } from "../evidence/sensitive-json.js";
 import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, RUN_BUNDLE_V3_SCHEMA, } from "../run/bundle.js";
-import { ContainedReadRefusedError, refusalText } from "../run/contained-output.js";
+import { ContainedReadRefusedError, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, } from "../run/contained-output.js";
 import { isCleanupResult, isRunBundle } from "../run/bundle-shape.js";
-import { loadStreamTraces } from "../run/stream-trace.js";
+import { loadStreamTraces, StreamTraceTooLargeError } from "../run/stream-trace.js";
 import { readRunJsonIfExists, readRunTextIfExists, resolveRunPath, runJsonValue, } from "../run/locate.js";
 import { SANDBOX_RECEIPTS_ARTIFACT } from "../run/sandbox-receipts.js";
 import { isRecord } from "../run/type-guards.js";
@@ -79,7 +79,8 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
     const bundlePath = path.join(runPaths.absoluteRunRoot, RUN_BUNDLE_FILE);
     const bundleRead = await readRunJsonIfExists(runPaths, RUN_BUNDLE_FILE);
     // Every check below reads the streams with their traces loaded; a trace that does not match its
-    // index fails the evidence-artifacts check and its stream is checked without its items.
+    // index fails the evidence-artifacts check, and its stream, like one past the read limit, is
+    // checked without its items.
     const traces = await loadTraces(runPaths, runJsonValue(bundleRead));
     const { bundle, recorded, refusedTraces } = traces;
     const cleanupRead = await readRunJsonIfExists(runPaths, "cleanup.json");
@@ -102,9 +103,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
         unscannedArtifacts.files.push(SANDBOX_RECEIPTS_ARTIFACT);
     }
     const publicSafetyFindings = await scanRunPublicSafetyArtifacts(runPaths, derivedPublicSafetyFindings, {
-        recordingPaths: new Set(bundle
-            ? bundle.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : []))
-            : []),
+        recordingPaths: recordingPaths(bundle),
         screenshotPaths: bundle ? streamScreenshotPaths(bundle) : new Set(),
         // A run from before 0.110 with no receipts still names its ids in run.json.
         sandboxIds: [...new Set([...journaledSandboxIds, ...keyedSandboxIds(recorded)])],
@@ -127,7 +126,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
             : `public-safety findings: ${publicSafetyFindings.slice(0, 5).join(", ")}`,
     });
     const missingEvidenceArtifacts = bundle
-        ? await missingLocalEvidenceArtifacts(runPaths, bundle)
+        ? await missingLocalEvidenceArtifacts(runPaths, bundle, traces.pastReadLimit)
         : [];
     const redactedShapeFrames = bundle
         ? await redactedShapeFramePaths(runPaths, bundle)
@@ -155,6 +154,7 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
         : { warnings: [], unfinished: undefined };
     const warnings = bundle
         ? [
+            ...traces.unreadTraces,
             ...rawScreenshotPostureWarnings(bundle, redactedShapeFrames),
             ...undeclaredSubjectStateWarnings(bundle),
             ...desktopGeometryWarnings(bundle),
@@ -238,6 +238,8 @@ async function loadTraces(runPaths, stored) {
             recorded: stored,
             refusedTraces: [],
             refusedStreams: new Set(),
+            unreadTraces: [],
+            pastReadLimit: new Set(),
             ...scanned,
             pages: [],
         };
@@ -250,15 +252,34 @@ async function loadTraces(runPaths, stored) {
                 scanned[scan === "sensitive" ? "sensitive" : "opaque"].push(file);
         },
     });
+    // A file whose index records more than the read limit is not read. One past the limit on disk
+    // too is listed as unscanned, so its run grades local_only; one under it does not match its index.
+    const unread = [];
+    for (const error of refused)
+        if (error instanceof StreamTraceTooLargeError && (await pastReadLimit(runPaths, error.file))) {
+            unread.push(error);
+            scanned.opaque.push(error.file);
+        }
     return {
         bundle,
         recorded: bundle,
-        refusedTraces: refused.map((error) => error.message),
+        refusedTraces: refused
+            .filter((error) => !unread.some((past) => past === error))
+            .map((error) => error.message),
         refusedStreams: new Set(refused.map((error) => error.streamId)),
+        unreadTraces: unread.map((error) => error.message),
+        pastReadLimit: new Set(unread.map((error) => error.file)),
         ...scanned,
         pages: pageFindings(bundle),
     };
 }
+/** Whether the run file at `file` holds more than RUN_ARTIFACT_MAX_BYTES, read only when it does not. */
+async function pastReadLimit(runPaths, file) {
+    const read = await readContainedRegularFile(runPaths, file, RUN_ARTIFACT_MAX_BYTES);
+    return read.status === "refused" && read.reason === "too-large";
+}
+/** The continuous recordings the bundle registers, which CONTINUOUS_MEDIA grades. */
+const recordingPaths = (bundle) => new Set(bundle?.streams.flatMap((stream) => (stream.recording ? [stream.recording.path] : [])) ?? []);
 /** The trace scan's results, beside the walk's: each file named once, then each page finding. */
 function addTraceScan(traces, findings, unscanned) {
     for (const file of traces.sensitive)

package/docs/architecture/actor-contract.md

@@ -168,7 +168,9 @@ export interface ActorTraceItem {
   screenshotRef?: { path: string; redaction: "blurred" | "ocr_scrubbed" | "none" };
   text?: string; // redacted
   page?: { origin: string; path: string }; // computer-use screenshot items; redacted, no query
-  // computer-use: the wait ui_action during which a watch of a turn that only waited ended
+  // computer-use: the wait ui_action during which a watch of a turn that only waited ended, or a
+  // "watched the screen" notice for a watch no wait carries (a held participant's turn of only
+  // screenshots, or the watch after its repeated action past the no-progress limit)
   watch?: {
     limitMs: number;
     askedMs: number; // what the turn's waits asked for; above limitMs past the watch's growth cap

package/docs/architecture/observer.md

@@ -39,10 +39,22 @@ account participant's `executionProfile` without its receipts. `events.ndjson` i
 contract that live adapters update while a run is active.
 
 `observer/index.html` carries both parts: the data slot holds observer-data.json's
-content, and `<script id="observer-items" type="application/octet-stream"
-data-encoding="gzip">` holds the items and full artifact lists (`humanish.observer-items.v1`, by stream id)
-gzip-compressed in base64, which a `file://` page decodes without a fetch. Real
-trace items compress about eight times. The page joins the two before it renders
+content, and `<script id="observer-items" type="application/json">` holds the items
+and full artifact lists by stream id (`humanish.observer-items.v2`) as
+`{ schema, runId, streams }`, where `streams` lists one entry for each participant: its
+JSON with its stream id, gzip-compressed in base64, which a `file://` page decodes
+without a fetch. The ids stay inside the compressed entries because verify's scan
+reads the element's plain text. There, an id such as `GITHUB_TOKEN` before a long
+base64 value reads as a credential, and `https://` with a later id shaped like an
+address at an E2B host reads as one E2B URL across the base64 between them. Each participant is packed
+(`src/observer/page-data.ts`) and decoded (`observer/lib/data.ts`) on its own, so no
+string holds two participants' items. A run of 25 participants with
+30 MiB traces, 786 MB together, past V8's longest string of 536,870,888 characters,
+renders to a 138 MiB page. The page itself is one string, at about 0.18 characters
+for each trace byte, so it passes that limit near 3 GB of traces, and memory may run
+out first; neither has been measured past 25 participants. Real trace items compress
+about eight times. The page
+joins the two before it renders
 (`joinObserverData` in `src/observer/participant-items.ts`), so every view reads the
 same data as before. A stream whose screenshot entries moved records how many in
 `screenshotArtifacts`, and the page renders nothing from items that are another
@@ -83,9 +95,14 @@ public-safe metadata.
 
 The browser polls `observer-feed.json` with `no-store` caching: the server's
 projection of the run as `{ data, items }`, observer-data.json's content and the
-items, from one read of the run per poll. While a participant runs, its entry in
-`items` carries `live`, a cursor `<position>.<generation>.<items>.<bytes>` naming its
-live file (`live/<position>.<generation>.ndjson`) and how far the list goes. The page
+items packed as the page packs them (`observerFeedBody`), from one read of the run
+per poll. The feed compresses each entry at gzip level 1 on the libuv thread pool, one
+participant at a time, so the server answers other requests while it builds a poll.
+Every poll sends every finished participant's items again: on the 25-participant run
+above a poll takes 17 to 20 seconds, past the 15 seconds the page waits, so that page
+never updates and says the server stopped answering. While a participant runs, its entry in `items` carries `live`, a cursor
+`<position>.<generation>.<items>.<bytes>` naming its live file
+(`live/<position>.<generation>.ndjson`) and how far the list goes. The page
 sends the cursors of its last body back as `?after=<cursor>,<cursor>`, and the server
 then reads and sends only the items past each one, marking that entry with
 `liveAfter`, the cursor they follow (`src/observer/feed-cursors.ts`). A cursor for an

package/docs/architecture/state-driven-executor.md

@@ -100,10 +100,13 @@ action**, not a fatal error:
   `budget_reached` after material progress), a `CuaAbortError` as `harness_error`,
   and any genuine non-`CommandExitError` adapter fault as `actor_error`.
 - **No infinite loop.** A skipped action changes nothing on screen, so it is not
-  progress. A run that keeps failing every action makes no progress and still
-  terminates through the existing idle / no-progress backstop
-  (`gave_up`). The resilience only converts a _single flaky command_ from fatal
-  to survivable; it never masks a genuinely stuck run.
+  progress. A run that keeps repeating a failing action makes no progress and
+  ends through the no-progress backstop (`gave_up`) at 20 such turns in a row.
+  A participant held to its scheduled end keeps its session through repeats on
+  an unchanged screen, which is how it waits on a page that changes only on
+  reload, but 20 repeats in a row that never reached the desktop end it the
+  same way. The resilience only converts a _single flaky command_ from fatal
+  to survivable.
 
 Public-safety: the notice text carries only the substrate's own stderr (tailed +
 whitespace-collapsed) and a numeric exit code, and is still run through the loop's

package/docs/contracts/run-bundle.md

@@ -20,7 +20,7 @@ writer (`src/run/run.ts`, through `splitStreamTraces` in `src/run/stream-trace.t
 each stream with an `actor`:
 
 - the trace file: the actor trace (`humanish.actor-trace.v1`) with every item, plus `artifacts`,
-  the stream's screenshot entries. Its path is the stream's actor trace artifact (`actor.json` for
+  the stream's screenshot entries, as one line of compact JSON. Its path is the stream's actor trace artifact (`actor.json` for
   one participant, `actors/<stream>.json` for more, `actor-<surface>.json` on the scripted route),
   or `actors/<n>.json`, `n` its position in `streams[]` (from 1), for a stream with none or whose
   trace artifact an earlier stream claimed. Names of that form are never reused as a stream's own
@@ -65,7 +65,12 @@ names, is refused before any file is read. The writer claims names the same way.
 must have an index: an actor with no index, with
 or without inline `items`, is refused, and so is one with both an index and inline `items`.
 verify reports a refused trace in the `local evidence artifacts exist` check, so the run is
-`blocked`. verify also scans the bytes of each trace it loaded with the public-safety text scan,
+`blocked`. A trace or live file whose index records more than the limit is reported that way too,
+unless the file on disk is a single-link regular file verify can open that holds more than 32 MiB.
+verify lists such a file under `UNSCANNED_ARTIFACT`, so the run is `local_only`. It adds the
+refusal to its warnings and checks that participant without its items. Where the run cites the
+file as evidence, verify counts it as present if it is still past 32 MiB when that check reads it;
+a citation as a screenshot or recording is still checked as one, so the run is `blocked`. verify also scans the bytes of each trace it loaded with the public-safety text scan,
 apart from its walk of the run folder, so no path exemption the walk makes applies to a trace.
 run.json's digest, which an analysis record binds, covers each index and so each trace.
 
@@ -148,6 +153,9 @@ projection is served.
 observer-data.json is built from the loaded bundle. From 0.124.0 it leaves out each participant's
 trace items, which stay in the traces, and from this release it is `humanish.observer-data.v3`,
 which also leaves out each participant's per-request lists (docs/architecture/observer.md).
+The Observer page and `observer-feed.json` carry the items as `humanish.observer-items.v2`, each
+participant's entry gzip-compressed on its own, so `humanish observe` renders a run whose traces
+together pass V8's longest string. It was measured on 25 participants with 30 MiB traces.
 
 ## Per-request lists
 
@@ -371,6 +379,12 @@ An Observer that does not render is an `evidence` failure known only after
 show the run without it. Messages pass the same redaction and sandbox id scrub
 as the rest of the bundle.
 
+After that write, `Run.finish` replaces each raw sandbox id `sandbox-receipts.ndjson` names in the
+run's other text files with its label (`scrubRunSandboxIds` in `src/run/sandbox-ids.ts`). A file
+the sweep cannot read, such as a trace past the 32 MiB read limit, may still name a sandbox. The run
+still finishes: `Run.finish` writes `run.json` again with a `sandbox-ids.unresolved` warn event that
+names each such file and why.
+
 When a signal stops a live run, the handler writes `interrupted` into the last
 flushed `run.json`, and every later write of that run keeps it. A run stopped
 before its first flush has no `run.json`; its `status.json` is the record.