@foldrun/core 0.4.0 → 0.5.0

package/src/store.ts

@@ -20,12 +20,15 @@
 //
 // An account is a named directory (per OKF: tenancy is a hosting concern).
 
+import type { BrowserPodOutcome } from "./browser-pod.ts";
 import fs from "node:fs";
 import path from "node:path";
 import { recordRevision, registerTreeReader, type RevisionFile } from "./history.ts";
-import { dataRoot, singleWorkspace } from "./paths.ts";
+import { dataRoot, singleWorkspace, singleAccountRoot, entriesNoFollow } from "./paths.ts";
 import { platform } from "./platform.ts";
+import { toLF, asRaw } from "./eol.ts";
 import type { TestEffect } from "./test-mode.ts";
+import type { OperatorEvent } from "./operator.ts";
 import matter from "gray-matter";
 
 /**
@@ -40,16 +43,22 @@ import matter from "gray-matter";
 export function readFrontmatter(file: string): Record<string, unknown> {
   return matter(fs.readFileSync(file, "utf8")).data as Record<string, unknown>;
 }
-import { ownToolNames, legacyUseNames } from "./tool-names.ts";
+import { ownToolNames, legacyUseNames, retiredToolNames } from "./tool-names.ts";
 import { refNames } from "./refs.ts";
 import { parseBudget, budgetProblem } from "./budget.ts";
+import { timezoneProblem } from "./clock.ts";
+import { parseStepLimits, readLimits } from "./limits.ts";
+import { webProblems, webWarnings, runnerEngines } from "./providers.ts";
+import { actionProblems } from "./web-actions.ts";
+import { languageProblem } from "./language.ts";
+import { localeProblems } from "./locale.ts";
 import {
   readBundle, syncIndex, appendLog, provenanceMarks, syncWorkspaceBundles,
 } from "./okf.ts";
 import { readTransport, KINDS } from "./kinds.ts";
 import { providerPreset, looksOpenAiShaped, PROTECTED_PARAMS, type WireFormat, type AuthShape } from "./providers.ts";
 import { starterFiles, accountFiles } from "./starter.ts";
-import { trimSlashes } from "./paths.ts";
+import { trimSlashes, MAX_EDITABLE_FILE } from "./paths.ts";
 
 // Where workspaces live. The hosted app keeps many under data/; the CLI runs
 // against one folder, which is what `foldrun run ./my-desk` has to mean.
@@ -184,13 +193,14 @@ export function workspaceDir(tenant: string, workspace: string) {
  * The account root — where `library/`, account secrets and the account-wide
  * AGENTS.md live.
  *
- * On a laptop there is no account, so it is the workspace's parent: `my-desk/`
- * sits beside `library/` and an `AGENTS.md` covering everything there. Same
- * rule libraryDir uses, so the two never disagree about where "up" is.
+ * On a laptop it is wherever `singleAccountRoot` says: the workspace's parent
+ * for a flat `my-desk/`, and the account root two levels up for a workspace
+ * inside `my-account/workspaces/`. Same rule libraryDir uses, so the two never
+ * disagree about where "up" is.
  */
 export function accountDir(tenant: string) {
   const single = singleWorkspace();
-  if (single) return path.resolve(single, "..");
+  if (single) return singleAccountRoot()!;
   assertSafeName(tenant, "tenant");
   return path.join(dataRoot(), tenant);
 }
@@ -303,15 +313,38 @@ export function assertCanonicalCase(rel: string) {
  * next deploy or silently handed to every container — both invisible until
  * someone is bitten.
  */
-export const PLATFORM_FILES = ["secrets.json", "hooks.json", "hook-deliveries.jsonl", ".repo.json"];
+// trigger-log.jsonl: the scheduler's record of why a flow did or did not
+// fire (trigger-log.ts). Before it was listed here every deploy erased it.
+export const PLATFORM_FILES = ["secrets.json", "hooks.json", "hook-deliveries.jsonl", ".repo.json", "trigger-log.jsonl"];
 
 /** True for anything the platform, not the author or the agent, writes. */
 export function isPlatformPath(rel: string): boolean {
   const norm = rel.replaceAll("\\", "/");
   if (PLATFORM_FILES.includes(norm)) return true;
+  // The vault's lock and in-flight temp files (secrets.ts#mutateVaultFile)
+  // are the vault, as far as anything outside the platform is concerned.
+  if (/(^|\/)secrets\.json\./.test(norm)) return true;
+  if (norm === "trigger-log.jsonl.tmp") return true;
   return norm === "runs" || norm.startsWith("runs/") || norm === ".foldrun" || norm.startsWith(".foldrun/");
 }
 
+/** What a deploy keeps whatever it ships — the rule above saveWorkspace's
+ *  body. planDeploy reports removals through the same test, so a plan never
+ *  lists a file the save would keep. */
+export function keptOnDeploy(rel: string, shipped: ReadonlySet<string>): boolean {
+  return (
+    // Platform bookkeeping (the vault, hook rotation state, the delivery
+    // log, the trigger log, run history) — losing any of it on deploy
+    // silently breaks something: agents lose secrets, a rotated hook
+    // un-rotates, the record of why a schedule skipped is gone.
+    isPlatformPath(rel) ||
+    /(^|\/)state\//.test(rel) ||
+    rel === STORAGE_DIR ||
+    rel.startsWith(`${STORAGE_DIR}/`) ||
+    (/(^|\/)memory\/[^/]+\.md$/.test(rel) && !shipped.has(rel))
+  );
+}
+
 export function saveWorkspace(
   tenant: string,
   workspace: string,
@@ -373,15 +406,7 @@ export function saveWorkspace(
   // about it. Before this, every deploy silently erased everything the agents
   // had learned.
   const shipped = new Set(files.map((f) => path.normalize(f.path)));
-  const isAgentOwned = (rel: string) =>
-    // Platform bookkeeping (the vault, hook rotation state, the delivery
-    // log, run history) — losing any of it on deploy silently breaks
-    // something: agents lose secrets, a rotated hook un-rotates.
-    isPlatformPath(rel) ||
-    /(^|\/)state\//.test(rel) ||
-    rel === STORAGE_DIR ||
-    rel.startsWith(`${STORAGE_DIR}/`) ||
-    (/(^|\/)memory\/[^/]+\.md$/.test(rel) && !shipped.has(rel));
+  const isAgentOwned = (rel: string) => keptOnDeploy(rel, shipped);
 
   // What is there now, for the revision: every editable file's content
   // before this save replaces the tree.
@@ -399,7 +424,7 @@ export function saveWorkspace(
   const snapshot = fs.existsSync(dir) ? fs.mkdtempSync(path.join(dataRoot(), ".keep-")) : null;
   const preserved: string[] = [];
   if (snapshot) {
-    for (const entry of fs.readdirSync(dir, { recursive: true })) {
+    for (const entry of entriesNoFollow(dir)) {
       const rel = String(entry).split(path.sep).join("/");
       const from = path.join(dir, rel);
       try {
@@ -546,10 +571,15 @@ export interface McpSpec {
   headers: Record<string, string>;
 }
 
+/** `outward: true` in a tool's frontmatter: this one sends, posts, buys,
+ *  publishes or uploads. It changes nothing at run time — `check` uses it to
+ *  insist the step that grants it has a verify or a gate. */
+export type OutwardMark = { outward?: boolean };
+
 export type ToolDef =
-  | { kind: "http"; name: string; spec: ApiSpec }
-  | { kind: "script"; name: string; spec: Record<string, unknown> }
-  | { kind: "mcp"; name: string; spec: McpSpec };
+  | ({ kind: "http"; name: string; spec: ApiSpec } & OutwardMark)
+  | ({ kind: "script"; name: string; spec: Record<string, unknown> } & OutwardMark)
+  | ({ kind: "mcp"; name: string; spec: McpSpec } & OutwardMark);
 
 /**
  * The program inside a single-file script tool: the first fenced block whose
@@ -585,6 +615,16 @@ export function fencedCodeBlock(
   return null;
 }
 
+/**
+ * `outward: true` — this tool changes something that is not ours: it sends,
+ * posts, buys, publishes, uploads. The runtime does not treat it differently;
+ * `check` does, because the step that uses one is the step where a silent
+ * failure costs something that cannot be taken back. See `lintFlow`.
+ */
+export function toolIsOutward(data: Record<string, unknown>): boolean {
+  return data.outward === true;
+}
+
 export function parseToolDef(data: Record<string, unknown>, fallbackName: string, body?: string): ToolDef | null {
   const name = typeof data.name === "string" ? data.name : fallbackName;
   // `transport:`, or a legacy `type: http|script|mcp` from before `type:` meant
@@ -652,6 +692,76 @@ export function parseToolDef(data: Record<string, unknown>, fallbackName: string
  *
  * Flat files keep working unchanged — the shape is a migration, not a break.
  */
+/**
+ * A folder tool's `requirements.txt` and `package.json`, as a `runtime:`
+ * block. Requirement lines only: comments and blanks are left out, and so
+ * are options — whole option lines (`-r`, `--index-url`, `-e`) and the ones
+ * a requirement carries (`--hash=…`). Options never reach the installer,
+ * which takes them from the same argv as its operands; their NAMES are kept
+ * in `ignored`, never their values (an index URL can carry a password), so
+ * the build log can say what was not applied. Anything else that is not a
+ * requirement is refused later by parseRuntime with a log line, the same as
+ * it would be in tool.md. `dependencies` only — a tool's dev dependencies
+ * are its author's, not its runtime's.
+ */
+export function folderRuntime(folder: string): Record<string, unknown> | null {
+  const out: { packages?: string[]; npm?: string[]; node?: boolean; ignored?: string[] } = {};
+  const req = path.join(folder, "requirements.txt");
+  if (fs.existsSync(req)) {
+    const packages: string[] = [];
+    const ignored = new Set<string>();
+    // Logical lines: a trailing backslash continues onto the next, which is
+    // how pip-compile --generate-hashes writes every pin. Read line by line,
+    // `pandas==2.1 \` became `pandas==2.1\`, was refused as invalid, and
+    // its hash lines were dropped as options: a hash-pinned file installed
+    // nothing at all.
+    const logical = fs.readFileSync(req, "utf8").replace(/\\\r?\n/g, " ").split(/\r?\n/);
+    for (const raw of logical) {
+      const line = raw.replace(/(^|\s)#.*$/, "").trim();
+      if (!line) continue;
+      // The requirement is what comes before its first option.
+      const [head, ...opts] = line.split(/\s+(?=-)/);
+      for (const o of line.startsWith("-") ? [line, ...opts] : opts) ignored.add(o.split(/[\s=]/)[0]);
+      if (line.startsWith("-")) continue;
+      const requirement = head.replace(/\s+/g, "");
+      if (requirement) packages.push(requirement);
+    }
+    if (packages.length) out.packages = packages;
+    if (ignored.size) out.ignored = [...ignored];
+  }
+  const pkg = path.join(folder, "package.json");
+  if (fs.existsSync(pkg)) {
+    try {
+      const deps = (JSON.parse(fs.readFileSync(pkg, "utf8")) as { dependencies?: Record<string, string> }).dependencies ?? {};
+      const npm = Object.entries(deps).map(([name, range]) => (range && range !== "*" && range !== "latest" ? `${name}@${range}` : name));
+      if (npm.length) {
+        out.npm = npm;
+        out.node = true;
+      }
+    } catch {
+      // An unreadable package.json declares nothing; tool.md still can.
+    }
+  }
+  return out.packages || out.npm || out.ignored ? out : null;
+}
+
+/** tool.md's own `runtime:` plus what the folder's files add. */
+function mergeRuntimeBlocks(own: unknown, extra: Record<string, unknown>): Record<string, unknown> {
+  const base = own && typeof own === "object" && !Array.isArray(own) ? { ...(own as Record<string, unknown>) } : {};
+  const list = (v: unknown) => (Array.isArray(v) ? v.map(String) : []);
+  const packages = [...new Set([...list(base.packages ?? base.pip), ...list(extra.packages)])];
+  const npm = [...new Set([...list(base.npm), ...list(extra.npm)])];
+  const ignored = [...new Set([...list(base.ignored), ...list(extra.ignored)])];
+  delete base.pip;
+  return {
+    ...base,
+    ...(packages.length ? { packages } : {}),
+    ...(npm.length ? { npm } : {}),
+    ...(ignored.length ? { ignored } : {}),
+    ...(extra.node && base.node === undefined ? { node: true } : {}),
+  };
+}
+
 function readToolDir(dir: string, scope: "workspace" | "account" = "workspace"): Record<string, ToolDef> {
   if (!fs.existsSync(dir)) return {};
   const out: Record<string, ToolDef> = {};
@@ -678,8 +788,17 @@ function readToolDir(dir: string, scope: "workspace" | "account" = "workspace"):
       if (folder && typeof d.run === "string" && !/^(workspace|account|shared|library)\//.test(d.run)) {
         d.run = `${scope}/tools/${folder}/${d.run.replace(/^\.\//, "")}`;
       }
+      // The ecosystem's own dependency files, beside the code that needs them,
+      // count as `runtime:` — a tool copied out of a repo keeps working.
+      if (folder) {
+        const extra = folderRuntime(path.join(dir, folder));
+        if (extra) d.runtime = mergeRuntimeBlocks(d.runtime, extra);
+      }
       const def = parseToolDef(d, fallbackName, content);
-      if (def) out[def.name] = def;
+      // `outward: true` rides on the definition so a caller that resolved the
+      // grants — `check` — can ask which agents can act outside the workspace
+      // without reading every tool file a second time.
+      if (def) out[def.name] = toolIsOutward(d) ? { ...def, outward: true } : def;
       else broken.push(`${fallbackName}: no base, run, command or fenced code block — nothing to call`);
     } catch (err) {
       // A malformed definition must not fail every run in the workspace. But
@@ -756,7 +875,9 @@ export interface ApiSpec {
   openapi?: string;
   /** Which of the document's operations to expose — operationIds or
    *  `"METHOD /path"` strings. Absent: every operation, capped at 60.
-   *  Present: only these, and the generic `call_<api>` tool is withheld. */
+   *  Present: only these, and the generic `call_<api>` tool is withheld —
+   *  always. If none of them resolve (document missing, moved, or an
+   *  operation renamed) the API gets no tools that run: it fails closed. */
   operations?: string[];
   /** Calls per second this API may see from one step: `count` is the burst
    *  the bucket holds, `perSec` the refill rate. `"5/s"` → {5, 5};
@@ -784,9 +905,15 @@ export interface AgentInfo {
   /** Names still written under the removed `use:` key. Nothing is granted
    *  for them; `foldrun check` and the run log say what to write instead. */
   legacyUse: string[];
+  /** Retired built-in names still in `tools:` (files, bash) — granted, but
+   *  `check` says what to write instead. */
+  retiredTools: string[];
   /** Colleagues this agent may consult mid-run (`agents:`) — each becomes a
    *  consult_<name> tool. The team's edges, as the author drew them. */
   consults: string[];
+  /** Colleagues this agent may DELEGATE to (`subagents:`) — each runs with
+   *  its own context and its own tools, no wider than this agent's. */
+  subagents: string[];
   /** The `skills:` allowlist, or null when the field is absent — which is
    *  not the same thing: absent inherits every skill in scope, an empty
    *  list withholds all of them. */
@@ -798,6 +925,32 @@ export interface AgentInfo {
   budget: number | null;
   /** What is wrong with the `budget:` line, or null. */
   budgetProblem: string | null;
+  /** `timezone:` — the calendar this agent works to, nearest-wins over its
+   *  flow's, its workspace's and the account's. Null inherits. */
+  timezone: string | null;
+  /** What is wrong with the `timezone:` line, or null. */
+  timezoneProblem: string | null;
+  languageProblem: string | null;
+  /** region:/currency:/units:/calendar: values that cannot be read. */
+  localeProblems: string[];
+  /** `web:` values that cannot work. The run says
+   *  so in its trail and carries on; check and deploy say so first. */
+  webProblems: string[];
+  /** `web:` that works but should change — the old `session:` key, a pinned
+   *  user agent behind the runner image's Chrome (when this process knows
+   *  that Chrome: FOLDRUN_RUNNER_ENGINES). Warnings, never refusals. */
+  webWarnings: string[];
+  /** `schedule:` written on an agent, which nothing runs — only a flow has
+   *  a clock. The message, or null when there is no such line. */
+  scheduleProblem: string | null;
+  /** `limits:` — the agent's own per-step call limits, as readable. */
+  limits: Record<string, number>;
+  /** What is wrong with the `limits:` block's shape; key-vs-grant problems
+   *  need the tool lists, and `check` adds them (limits.ts limitKeyProblems). */
+  limitProblems: string[];
+  /** Tools this agent declares inline rather than in `tools:` — `apis:`,
+   *  `scripts:` and `mcpServers:` names — which a limit may also name. */
+  inlineTools: string[];
 }
 
 // Recognised HTTP verbs a tool may declare. Deliberately NOT named
@@ -1001,6 +1154,11 @@ export function parseApis(raw: unknown): ApiSpec[] {
 export interface FlowStep {
   agent: string;
   instruction: string;
+  /** The instruction was written over more than one line and the parser
+   *  joined them. It runs, but `foldrun check` says so: a wrapped
+   *  instruction is one editor keystroke away from being a paragraph of
+   *  prose the parser has to guess about. */
+  wrapped?: boolean;
   group: number; // steps sharing a group number run in parallel
   optional: boolean; // "2?" — failure doesn't fail the flow
   /** Set when the step targets another flow (`[[flow:name]]`) instead of an agent. */
@@ -1095,6 +1253,9 @@ export interface FlowStep {
   /** `max_turns:` — the most model turns this step may take before it is
    *  stopped, beside `budget:` (money) and `timeout:` (time). */
   maxTurns?: number;
+  /** `limits: {web.search: 10}` — this step's call limits, over the agent's
+   *  (nearest wins per key). See limits.ts. */
+  limits?: Record<string, number>;
   /** 1-indexed line in the flow file. Diagnostics without a line make you
    *  search; every real linter emits file:line. */
   line?: number;
@@ -1141,7 +1302,10 @@ export interface FlowInfo {
    *  with `on:` saying which endings count. The finished run's summary and
    *  result become this run's task. */
   after: string | null;
-  on: "completed" | "failed" | "any";
+  /** `blocked` is a completed run whose verdict is BLOCKED — the work
+   *  refused itself. `completed` no longer includes those: a follow-up to a
+   *  publish that did not happen should not run as if it had. */
+  on: "completed" | "failed" | "blocked" | "any";
   /** `trigger: once` — an ISO 8601 instant; fires the first tick at or after
    *  it, once, then never again. */
   at: string | null;
@@ -1197,6 +1361,13 @@ export interface FlowInfo {
    *  failed all week is not going to fix itself, and every one of those runs
    *  costs money and sends mail. Null: never quarantined. */
   disableAfter: number | null;
+  /** `pause_when:` — a marker (DONE, NOTHING LEFT) that, leading a line of
+   *  any step's reply in the flow's latest run, pauses its schedule: the
+   *  work is finished, so firing again would only spend money saying so.
+   *  Derived from that run, like disable_after, so a run that finds work
+   *  again (a person clicking Run after adding some) lifts it by itself.
+   *  Null: never paused. */
+  pauseWhen: string | null;
   /** `sla:` — seconds a run of this flow is expected to take. A run still
    *  going well past it is reported once, as a notification, and keeps
    *  running: this is a smoke alarm, not a timeout. Null: no expectation. */
@@ -1220,6 +1391,17 @@ export interface FlowInfo {
    *  Only ever an opt-out of the safe default, never the other way round. */
   live: boolean;
 
+  /** `description:` — one line on what this flow is for, shown in listings
+   *  and the trace. Read here so a documented, scaffolded field means
+   *  something rather than sitting in every file unread. */
+  description: string | null;
+
+  /** Flow-level frontmatter values the parser could not read — a bad
+   *  `overlap:`/`priority:`/`catchup:`/`on:`/`signature:`, or a step line
+   *  whose `[[target]]` is malformed. Errors, the way a bad step option is,
+   *  rather than a silent default. */
+  frontProblems: string[];
+
   steps: FlowStep[];
 }
 
@@ -1270,6 +1452,14 @@ export function agentAssets(tenant: string, workspace: string, agent: string): A
   return { skills, memory };
 }
 
+/** `schedule:` on an agent runs nothing — only a flow has a clock. Named so
+ *  it fails loudly rather than deploying clean and never firing. */
+function agentScheduleProblem(data: Record<string, unknown>): string | null {
+  return data.schedule !== undefined
+    ? "schedule: an agent has no schedule of its own — only a flow runs on a clock. Put schedule: on the flow that runs this agent, or remove it."
+    : null;
+}
+
 /** A per-run `budget:` as a number, or null. A period other than "run"
  *  written here is a mistake the lint names; it is not silently a cap. */
 function runBudget(raw: unknown): number | null {
@@ -1277,6 +1467,23 @@ function runBudget(raw: unknown): number | null {
   return b && b.period === "run" ? b.usd : null;
 }
 
+/** The names an agent's inline tool fields grant: `apis:`, `scripts:` (an
+ *  object's name, or a file's base name) and `mcpServers:`. */
+function inlineToolNames(data: Record<string, unknown>): string[] {
+  const out: string[] = [];
+  if (Array.isArray(data.apis)) {
+    for (const a of data.apis) if (a && typeof a === "object" && typeof (a as { name?: unknown }).name === "string") out.push((a as { name: string }).name);
+  }
+  if (Array.isArray(data.scripts)) {
+    for (const sc of data.scripts) {
+      if (typeof sc === "string") out.push(path.basename(sc).replace(/\.[^.]+$/, ""));
+      else if (sc && typeof sc === "object" && typeof (sc as { name?: unknown }).name === "string") out.push((sc as { name: string }).name);
+    }
+  }
+  if (data.mcpServers && typeof data.mcpServers === "object") out.push(...Object.keys(data.mcpServers));
+  return out;
+}
+
 export function listAgents(tenant: string, workspace: string): AgentInfo[] {
   const dir = path.join(workspaceDir(tenant, workspace), "agents");
   if (!fs.existsSync(dir)) return [];
@@ -1296,11 +1503,22 @@ export function listAgents(tenant: string, workspace: string): AgentInfo[] {
         apis: parseApis(data.apis),
         ownTools: ownToolNames(data),
         legacyUse: legacyUseNames(data),
+        retiredTools: retiredToolNames(data),
         consults: refNames(data.agents),
+        subagents: refNames(data.subagents),
         skills: data.skills === undefined ? null : refNames(data.skills),
         secrets: Array.isArray(data.secrets) ? data.secrets.map(String) : [],
         budget: runBudget(data.budget),
         budgetProblem: budgetProblem(data.budget, ["run"]),
+        timezone: typeof data.timezone === "string" ? data.timezone : null,
+        timezoneProblem: timezoneProblem(data.timezone),
+        languageProblem: languageProblem(data.language),
+        localeProblems: localeProblems(data),
+        webProblems: [...webProblems(data), ...actionProblems(data)],
+        webWarnings: webWarnings(data, { chrome: runnerEngines()?.chrome, chromium: runnerEngines()?.chromium }),
+        scheduleProblem: agentScheduleProblem(data),
+        ...(() => { const l = readLimits(data.limits); return { limits: l.limits, limitProblems: l.problems }; })(),
+        inlineTools: inlineToolNames(data),
       };
     });
 }
@@ -1324,10 +1542,16 @@ const OPTION_RE = /^(\s+)([a-z_-]+):(.*)$/;
  *  swallowed as an unknown option, silently, along with any typo of a real
  *  key. The consistency suite reads this list against the docs. */
 const STEP_OPTION_KEYS = new Set([
-  "approve", "ask", "case", "delegate", "each", "effort", "else", "loop", "max", "max_turns", "model",
+  "approve", "ask", "case", "delegate", "each", "effort", "else", "limits", "loop", "max", "max_turns", "model",
   "on-fail", "onfail", "output", "parallel", "preview", "retry", "schema", "timeout", "until", "verify", "wait", "when",
 ]);
 
+/** A line that opens a markdown block rather than continuing a sentence:
+ *  a heading, a bullet, a numbered item, a quote, a rule, or a paragraph
+ *  that opens in bold. Tested against the line already trimmed, so it says
+ *  "this is a document" whatever margin the list gave it. */
+const MARKDOWN_BLOCK_RE = /^(?:#{1,6}\s|[-*+]\s|>\s|\d+[.)]\s|\*\*|__|---|\|)/;
+
 /** The most fan-out instances `parallel:` may run at once — the fan-out's
  *  own hard cap, since more slots than items is no cap. */
 export const PARALLEL_CAP = 20;
@@ -1389,7 +1613,7 @@ export function parseInstant(raw: unknown): string | null {
  * removed a leading OR a trailing quote independently, so a value that
  * merely *ended* with one lost it — and
  *
- *   verify: test "$(cat ../../storage/draft/published.run)" = "$FOLDRUN_RUN_ID"
+ *   verify: test "$(cat workspace/storage/draft/published.run)" = "$FOLDRUN_RUN_ID"
  *
  * reached bash unbalanced, which exited 2 with "unexpected EOF" on every
  * run. The step could never pass, whatever the agent did, and nothing said
@@ -1430,6 +1654,17 @@ export function unquote(raw: string): string {
  * The marker must also END at a boundary, so BLOCKED does not match
  * BLOCKEDBY.
  */
+/**
+ * The path of a `when: rows of <path>` condition, or null when the condition
+ * is a marker. `rows of` is the phrase `each:` uses for the same file, so a
+ * flow reads a CSV one way in both. The whole phrase is required: a bare
+ * `when: ROWS` stays the marker it always was.
+ */
+export function whenRowsPath(when: string): string | null {
+  const m = when.trim().match(/^rows\s+of\s+(\S.*)$/i);
+  return m ? m[1].trim() : null;
+}
+
 export function markerPresent(text: string | null | undefined, marker: string): boolean {
   const needle = marker.trim().toLowerCase();
   if (!needle || !text) return false;
@@ -1449,8 +1684,15 @@ export function markerPresent(text: string | null | undefined, marker: string):
 }
 
 export function parseFlow(file: string, raw: string): FlowInfo {
+  // A flow saved with CRLF (Windows, some editors) read as no steps at all:
+  // every line kept its "\r", which STEP_RE's `.` will not match. Read it as
+  // LF; the line count, and so every step's `line`, is the same.
+  raw = raw.replace(/\r\n/g, "\n");
   const { data, content } = matter(raw);
   const steps: FlowStep[] = [];
+  // Flow-level problems: a malformed step target (below) and unreadable
+  // frontmatter enums (before the return). Reported as errors by flow-lint.
+  const frontProblems: string[] = [];
   // Frontmatter is stripped by matter(), so add it back to keep line numbers
   // pointing at the real file rather than the body.
   const offset = raw.slice(0, raw.length - content.length).split("\n").length - 1;
@@ -1460,6 +1702,9 @@ export function parseFlow(file: string, raw: string): FlowInfo {
   // shape to be written out rather than named, because a schema is a
   // document and a one-line one is unreadable past three fields.
   let block: { step: FlowStep; indent: number; lines: string[] } | null = null;
+  // The step still accepting wrapped instruction lines, or null once
+  // anything has closed it. See the continuation rule below.
+  let open: FlowStep | null = null;
   const endBlock = () => {
     if (!block) return;
     const { step, lines } = block;
@@ -1500,26 +1745,51 @@ export function parseFlow(file: string, raw: string): FlowInfo {
         instruction: m[5].trim(),
         line: lineNo + offset,
       });
+      open = steps[steps.length - 1];
       continue;
     }
-    // An indented line that is not an option continues the instruction.
+    // A line shaped like a numbered step whose `[[target]]` STEP_RE would
+    // not accept — capitals or an underscore in the name — used to fall
+    // through and be swallowed as prose, so the step silently vanished.
+    // Name it instead: an agent is [a-z0-9-], and a real one that is merely
+    // missing is a separate, later error.
+    const shape = line.match(/^\s*\d+[?!]?\.?\s+\[\[(flow:)?([^\]]*)\]\]/);
+    if (shape && !STEP_RE.test(line)) {
+      frontProblems.push(`step \`[[${shape[1] ?? ""}${shape[2]}]]\` on line ${lineNo + offset}: a step targets an agent or flow named in lower case, digits and dashes — not \`${shape[2]}\`.`);
+    }
+    // An indented line that is not an option continues the instruction —
+    // but only while the step is still open.
     //
-    // Without this it was silently DROPPED. An instruction wrapped over
-    // three lines kept the first and discarded the rest, the run went
-    // green, and the agent worked from an instruction its author had not
-    // written — the worst failure this parser can have, because nothing
-    // anywhere reports it. Twenty-five live instructions across eight desks
-    // were being cut this way.
+    // Both directions of this have been wrong in production. Dropping the
+    // continuation silently cut twenty-five live instructions off mid
+    // sentence. Taking every indented line instead read the *wrapped lines
+    // of a bullet list* three paragraphs below the last step as orders: the
+    // gbp-desk publisher was told to "publish Tuesday's five every way step
+    // 3 could fail was also a way Thursday's five silently never went out".
     //
-    // Indentation is what makes it a continuation, exactly as it is for an
-    // option. Unindented prose between steps is still prose and still
-    // ignored, so a flow file's commentary is undisturbed.
+    // So a step's instruction ends where the step ends. A continuation is
+    // an indented line that follows the step line, or a previous
+    // continuation, with nothing in between — no blank line, no unindented
+    // line, no option, no schema block. Once any of those closes the step
+    // the instruction is finished, and prose below the last step is prose.
+    //
+    // Indented markdown never continues an instruction either. A heading, a
+    // bullet, a quote, a numbered item or a paragraph opening in bold is a
+    // document, not a sentence somebody wrapped, and the indentation is a
+    // list's own margin.
     const opt = line.match(OPTION_RE);
-    if (steps.length && /^\s+\S/.test(line) && !(opt && STEP_OPTION_KEYS.has(opt[2]))) {
-      const step = steps[steps.length - 1];
-      step.instruction = `${step.instruction} ${line.trim()}`.trim();
-      continue;
+    const isOption = !!opt && STEP_OPTION_KEYS.has(opt[2]);
+    if (open && /^\s+\S/.test(line) && !isOption) {
+      if (MARKDOWN_BLOCK_RE.test(line.trim())) {
+        open = null;
+      } else {
+        open.instruction = `${open.instruction} ${line.trim()}`.trim();
+        open.wrapped = true;
+        continue;
+      }
     }
+    // Anything that is not a continuation closes the step to further ones.
+    open = null;
     // Indented options belong to the step above them.
     if (opt && steps.length) {
       const step = steps[steps.length - 1];
@@ -1562,9 +1832,9 @@ export function parseFlow(file: string, raw: string): FlowInfo {
         else if (value === "items") step.each = "items";
         else if (/^rows\b/.test(value)) {
           step.each = "rows";
-          // "rows of ../../storage/leads.csv" — the path is the part after "of".
+          // "rows of workspace/storage/leads.csv" — the path is the part after "of".
           step.eachPath = value.replace(/^rows(\s+of)?\s*/, "").trim() || undefined;
-          if (!step.eachPath) problem("rows needs a file: each: rows of ../../storage/leads.csv");
+          if (!step.eachPath) problem("rows needs a file: each: rows of workspace/storage/leads.csv");
         }
         else problem("lines, items, or rows of <path>");
       }
@@ -1578,7 +1848,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
       }
       else if (key === "ask") { step.ask = value; }
       else if (key === "preview") {
-        step.preview = value.split(",").map((p) => p.trim().replace(/^(\.\.\/\.\.\/)?storage\//, "")).filter(Boolean);
+        step.preview = value.split(",").map((p) => p.trim().replace(/^(\.\.\/\.\.\/|workspace\/)?storage\//, "")).filter(Boolean);
       }
       else if (key === "delegate") step.delegate = refNames(value).slice(0, 5);
       else if (key === "max") {
@@ -1596,6 +1866,11 @@ export function parseFlow(file: string, raw: string): FlowInfo {
         if (n === undefined) problem(`a whole number of turns, 1 to ${MAX_TURNS_CAP}`);
         else step.maxTurns = n;
       }
+      else if (key === "limits") {
+        const read = parseStepLimits(value);
+        for (const p of read.problems) problem(p);
+        if (Object.keys(read.limits).length) step.limits = read.limits;
+      }
       else if (key === "schema") {
         if (!value) block = { step, indent: indentText.length, lines: [] };
         else if (/^[{[]/.test(value)) {
@@ -1609,6 +1884,21 @@ export function parseFlow(file: string, raw: string): FlowInfo {
     }
   }
   endBlock();
+  // A frontmatter enum written with a typo — `overlap: que` — read as null
+  // and ran with the silent default. flows.md promises otherwise ("a value
+  // the option cannot read is a check error, never a guess"); make it true
+  // for these too, not only for step options.
+  const badEnum = (key: string, val: unknown, allowed: string[]) => {
+    if (typeof val === "string" && val.trim() && !allowed.includes(val.trim())) {
+      frontProblems.push(`${key}: ${val} — the values are ${allowed.join(", ")}.`);
+    }
+  };
+  badEnum("overlap", data.overlap, ["skip", "queue"]);
+  badEnum("priority", data.priority, ["high", "normal", "low"]);
+  badEnum("catchup", data.catchup, ["none", "last"]);
+  badEnum("on", data.on, ["completed", "failed", "blocked", "any"]);
+  badEnum("signature", data.signature, ["github", "stripe", "slack", "hmac"]);
+
   steps.sort((a, b) => a.group - b.group);
   return {
     name: data.name ?? file.replace(/\.md$/, ""),
@@ -1626,7 +1916,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
     // `after: [[flow:publish]]` — a link or a bare name, read the same way
     // as every other file-naming field (refs.ts).
     after: (refNames(data.after)[0] ?? "").replace(/^flow:/, "").trim() || null,
-    on: data.on === "failed" || data.on === "any" ? data.on : "completed",
+    on: data.on === "failed" || data.on === "blocked" || data.on === "any" ? data.on : "completed",
     at: parseInstant(data.at),
     url: typeof data.url === "string" ? data.url.trim() : null,
     every: typeof data.every === "string" || typeof data.every === "number" ? (parseWait(String(data.every)) ?? null) : null,
@@ -1648,9 +1938,14 @@ export function parseFlow(file: string, raw: string): FlowInfo {
     disableAfter: Number.isFinite(Number(data.disable_after)) && Number(data.disable_after) > 0
       ? Math.min(100, Math.floor(Number(data.disable_after)))
       : null,
+    pauseWhen: typeof data.pause_when === "string" && data.pause_when.trim() && data.pause_when.trim().length <= 60
+      ? data.pause_when.trim()
+      : null,
     sla: durationOf(data.sla),
     approvers: approverList(data.approvers),
     approveWithin: durationOf(data.approve_within),
+    description: typeof data.description === "string" ? data.description.trim() || null : null,
+    frontProblems,
     steps,
   };
 }
@@ -1778,7 +2073,7 @@ function emitFlow(head: string, preamble: string[], groups: FlowBlock[][]): stri
  * and the diff is exactly the lines that changed. A flow with no
  * frontmatter gains the smallest one that can carry the trigger.
  */
-export function setFlowTrigger(
+function setFlowTriggerLF(
   raw: string,
   opts: { trigger: FlowTrigger; schedule?: string; timezone?: string },
 ): string {
@@ -1838,7 +2133,7 @@ export function setFlowTrigger(
  * the prefix is taken verbatim from the file and only the tail replaced. A
  * flow's markdown stays the author's.
  */
-export function updateFlowStepInstruction(raw: string, index: number, instruction: string): string {
+function updateFlowStepInstructionLF(raw: string, index: number, instruction: string): string {
   const { head, preamble, blocks } = splitFlowBlocks(raw);
   if (!Number.isInteger(index) || index < 0 || index >= blocks.length) {
     throw new Error(`no step ${index}`);
@@ -1862,10 +2157,10 @@ export function updateFlowStepInstruction(raw: string, index: number, instructio
   return emitFlow(head, preamble, groups);
 }
 
-export function updateFlowStep(
+function updateFlowStepLF(
   raw: string,
   index: number,
-  options: Partial<Record<"model" | "effort" | "retry" | "timeout" | "verify" | "when" | "case" | "else" | "loop" | "until" | "each" | "max", string | number | null>>,
+  options: Partial<Record<"model" | "effort" | "retry" | "timeout" | "verify" | "when" | "case" | "else" | "loop" | "until" | "each" | "max" | "limits", string | number | null>>,
 ): string {
   const { head, preamble, blocks } = splitFlowBlocks(raw);
   if (!Number.isInteger(index) || index < 0 || index >= blocks.length) {
@@ -1885,6 +2180,15 @@ export function updateFlowStep(
     loop: (v) => (Number(v) > 0 ? String(Math.min(5, Math.max(1, Math.floor(Number(v))))) : null),
     max: (v) => (Number(v) > 0 ? String(Math.min(20, Math.max(1, Math.floor(Number(v))))) : null),
     each: (v) => (v === "lines" ? "lines" : null),
+    // `{web.search: 10, calls: 300}` — one line, read the way parseFlow
+    // reads it; a value it would flag is refused rather than written.
+    limits: (v) => {
+      if (!v || v === "{}") return null;
+      const read = parseStepLimits(v);
+      if (read.problems.length) throw new Error(`limits: ${read.problems[0]}`);
+      const pairs = Object.entries(read.limits);
+      return pairs.length ? `{${pairs.map(([k, n]) => `${k}: ${n}`).join(", ")}}` : null;
+    },
   };
 
   const block = blocks[index];
@@ -1912,7 +2216,7 @@ export function updateFlowStep(
   return emitFlow(head, preamble, groups);
 }
 
-export function reorderFlowSteps(raw: string, groups: number[][]): string {
+function reorderFlowStepsLF(raw: string, groups: number[][]): string {
   const { head, preamble, blocks: ordered } = splitFlowBlocks(raw);
 
   const seen = new Set<number>();
@@ -1932,7 +2236,7 @@ export function reorderFlowSteps(raw: string, groups: number[][]): string {
 }
 
 /** Append a step as its own group at the end of the flow. */
-export function addFlowStep(
+function addFlowStepLF(
   raw: string,
   step: { target: string; subflow?: boolean; instruction?: string },
 ): string {
@@ -1947,7 +2251,7 @@ export function addFlowStep(
 }
 
 /** Drop one step, by its index in the flow's parsed steps. */
-export function removeFlowStep(raw: string, index: number): string {
+function removeFlowStepLF(raw: string, index: number): string {
   const { head, preamble, blocks } = splitFlowBlocks(raw);
   if (!Number.isInteger(index) || index < 0 || index >= blocks.length) {
     throw new Error(`no step ${index}`);
@@ -1956,6 +2260,20 @@ export function removeFlowStep(raw: string, index: number): string {
   return emitFlow(head, preamble, groupBlocks(kept));
 }
 
+// The rewriters above work on LF (eol.ts); the web route calls these with
+// the file as saved, so a CRLF flow is read as LF and written back as CRLF.
+export const setFlowTrigger = (raw: string, opts: Parameters<typeof setFlowTriggerLF>[1]): string =>
+  asRaw(raw, setFlowTriggerLF(toLF(raw), opts));
+export const updateFlowStepInstruction = (raw: string, index: number, instruction: string): string =>
+  asRaw(raw, updateFlowStepInstructionLF(toLF(raw), index, instruction));
+export const updateFlowStep = (raw: string, index: number, options: Parameters<typeof updateFlowStepLF>[2]): string =>
+  asRaw(raw, updateFlowStepLF(toLF(raw), index, options));
+export const reorderFlowSteps = (raw: string, groups: number[][]): string =>
+  asRaw(raw, reorderFlowStepsLF(toLF(raw), groups));
+export const addFlowStep = (raw: string, step: Parameters<typeof addFlowStepLF>[1]): string =>
+  asRaw(raw, addFlowStepLF(toLF(raw), step));
+export const removeFlowStep = (raw: string, index: number): string => asRaw(raw, removeFlowStepLF(toLF(raw), index));
+
 /** Blocks → the group structure they currently describe. */
 function groupBlocks(blocks: FlowBlock[]): FlowBlock[][] {
   const map = new Map<number, FlowBlock[]>();
@@ -2125,18 +2443,27 @@ function assertEditablePath(rel: string) {
  *  never be served. Listing them is honest — hiding them is what makes a file
  *  tree disagree with the filesystem it claims to show — but their contents
  *  are the vault and the money, so a reader gets the reason instead. */
-const ACCOUNT_SEALED = new Set(["secrets.json", "oauth-clients.json", "ledger.jsonl"]);
+// billing.json, oauth-connections.json and secret-health.json were listed and
+// served until 2026-09-24: any member of the account, a viewer included, could
+// open the Stripe customer id and billing email, and which connections exist.
+const ACCOUNT_SEALED: Record<string, string> = {
+  "secrets.json": "the vault — encrypted, and never served to a browser. Manage secrets in Settings.",
+  "oauth-clients.json": "OAuth client credentials — never served to a browser.",
+  "ledger.jsonl": "the billing ledger — append-only, read it through Usage and Wallet.",
+  "billing.json": "the account's billing settings — read and change them in Wallet.",
+  "oauth-connections.json": "connected apps and their health — see Settings → Connections.",
+  "secret-health.json": "secret usage bookkeeping — see Settings → Secrets.",
+};
 
 export function accountFileSealed(rel: string): string | null {
   const norm = rel.replaceAll("\\", "/");
-  if (ACCOUNT_SEALED.has(norm)) {
-    return norm === "secrets.json"
-      ? "the vault — encrypted, and never served to a browser. Manage secrets in Settings."
-      : norm === "oauth-clients.json"
-        ? "OAuth client credentials — never served to a browser."
-        : "the billing ledger — append-only, read it through Usage and Wallet.";
-  }
-  if (/^(billed|workspaces\/[^/]+\/runs)\//.test(norm)) {
+  if (/(^|\/)secrets\.json\.[^/]+$/.test(norm)) return "the vault's lock or a save in flight — never served.";
+  if (Object.hasOwn(ACCOUNT_SEALED, norm)) return ACCOUNT_SEALED[norm];
+  // What a move into the database leaves behind: billing.json.imported-<date>
+  // and the like, kept for a rollback — the same contents, so the same seal.
+  const moved = /^(.+\.json)\.imported-[\d-]+$/.exec(norm);
+  if (moved && Object.hasOwn(ACCOUNT_SEALED, moved[1])) return ACCOUNT_SEALED[moved[1]];
+  if (/^(billed|once|topups|workspaces\/[^/]+\/runs)\//.test(norm)) {
     return "generated bookkeeping, not an authored file.";
   }
   if (/^workspaces\/[^/]+\/secrets\.json$/.test(norm)) {
@@ -2151,7 +2478,7 @@ export function accountFileSealed(rel: string): string | null {
  *  honesty's clothes. `accountFileSealed` still refuses these if a path is
  *  constructed directly — the listing hides them, the reader guards them. */
 const ACCOUNT_BOOKKEEPING =
-  /^(billed\/|ledger\.jsonl$|oauth-clients\.json$)|(^|\/)runs\/|(^|\/)secrets\.json$/;
+  /^(billed\/|once\/|topups\/|ledger\.jsonl$|oauth-clients\.json$|billing\.json$|oauth-connections\.json$|secret-health\.json$|[^/]+\.json\.imported-[\d-]+$)|(^|\/)runs\/|(^|\/)secrets\.json(\.[^/]+)?$/;
 
 /**
  * The account directory as it actually is on disk.
@@ -2218,7 +2545,7 @@ export function listWorkspaceFiles(tenant: string, workspace: string): string[]
   const dir = workspaceDir(tenant, workspace);
   if (!fs.existsSync(dir)) return [];
   const out: string[] = [];
-  for (const entry of fs.readdirSync(dir, { recursive: true })) {
+  for (const entry of entriesNoFollow(dir)) {
     const rel = String(entry);
     if (/(^|\/)(runs|outputs)\//.test(rel)) continue;
     // Skip anything reached through a symlink — a stray link would otherwise
@@ -2264,7 +2591,9 @@ export function writeWorkspaceFile(
   content: string,
   meta: ChangeMeta = {},
 ) {
-  if (content.length > 256 * 1024) throw new Error("file too large");
+  // 512 KB: a folder tool's program is one file, and the gallery browser's is
+  // past 256 KB. Still a file a person edits, not a store for data.
+  if (content.length > MAX_EDITABLE_FILE) throw new Error("file too large");
   matter(content); // reject files whose frontmatter doesn't parse
   const p = path.join(workspaceDir(tenant, workspace), assertEditablePath(rel));
   const existed = fs.existsSync(p);
@@ -2445,9 +2774,11 @@ export function deleteWorkspacePath(tenant: string, workspace: string, rel: stri
   }
   // Whole-folder units: an agent, a skill, a folder tool. Each is one thing
   // to its reader, so each is one thing to delete.
-  if (/^agents\/[a-z0-9-]+$/.test(norm) ||
-      /^(skills|tools)\/[a-z0-9-]+$/.test(norm) ||
-      /^agents\/[a-z0-9-]+\/skills\/[a-z0-9-]+$/.test(norm)) {
+  // An underscore is allowed in the folder's name: a tool called
+  // `my_tool` is one thing too, and its tool.md is refused alone above.
+  if (/^agents\/[a-z0-9_-]+$/.test(norm) ||
+      /^(skills|tools)\/[a-z0-9_-]+$/.test(norm) ||
+      /^agents\/[a-z0-9_-]+\/skills\/[a-z0-9_-]+$/.test(norm)) {
     const gone = deletionsUnder(dir, norm);
     fs.rmSync(path.join(dir, norm), { recursive: true, force: true });
     recordRevision(tenant, workspace, gone, { message: `deleted ${norm}/`, ...meta });
@@ -2629,13 +2960,53 @@ export interface RunEvent {
    *  state write, a withheld secret. The run page lists these; the text is
    *  still the trace's line. See test-mode.ts. */
   effect?: TestEffect;
+  /** Set when a person was involved mid-step: a question the agent asked
+   *  (ask_person), its answer, or a message a person sent in (operator.ts). */
+  operator?: OperatorEvent;
+  /** Set on a tool event a SUB-AGENT made (`subagents:`): its name. The
+   *  trace labels the call with it; cost stays the step's. */
+  subagent?: string;
+  /** Set on an error a failed check wrote — `verify:` (its headline and its
+   *  detail), `output: json`, a schema. What the runner reads to decline a
+   *  retry of an outward step whose tools already ran. */
+  check?: boolean;
+}
+
+/** A question an agent asked a person while its step ran (tools: [ask]). */
+export interface StepQuestion {
+  id: string;
+  question: string;
+  options?: string[];
+  askedAt: string;
+  answer?: string;
+  answeredAt?: string;
+  by?: string | null;
+  /** true when the wait ran out with no answer. */
+  unanswered?: boolean;
+}
+
+/** A message a person sent into a running step, and when the agent got it. */
+export interface StepMessage {
+  text: string;
+  by?: string | null;
+  at: string;
+  deliveredAt: string;
 }
 
 /** One attempt of a step — see StepRecord.tries. */
 export interface StepAttempt {
-  /** Which attempt, 1-based: `attempts` on the step at the time. */
+  /** Which try, 1-based, in the order they ran: a retry is the next try,
+   *  and so is the full re-run after a slim go the browser pod was lost
+   *  under. Equal to the step's attempt (`attempts` at the time) unless
+   *  `attempt` says otherwise. */
   n: number;
-  status: "completed" | "failed";
+  /** The step's attempt this try belongs to, written only when it is not
+   *  `n` — after a lost slim go, its full re-run is try 2 of attempt 1. */
+  attempt?: number;
+  /** `lost`: a slim go the account's browser pod went away under, which
+   *  the step ran again on the full image within the same attempt — a row
+   *  of its own (image slim), before the full go's. */
+  status: "completed" | "failed" | "lost";
   costUsd: number | null;
   tokens: { input: number; output: number } | null;
   computeSecs: number | null;
@@ -2643,6 +3014,11 @@ export interface StepAttempt {
   finishedAt: string;
   /** The last error event this attempt wrote, when it failed. */
   error?: string;
+  /** The runner image this attempt ended on, and — when it browsed through
+   *  the account's pod from slim — what happened to the pod: reconnects,
+   *  the re-run on full, or why it was not re-run. */
+  image?: "full" | "slim";
+  browserPod?: string;
 }
 
 /** The step's totals across its attempts, from the rows. Null where no
@@ -2662,6 +3038,11 @@ export function sumAttempts(tries: StepAttempt[]): Pick<StepAttempt, "costUsd" |
 export interface StepRecord {
   agent: string;
   instruction: string;
+  /** Questions the agent asked a person mid-step (tools: [ask]), newest
+   *  last. One without an answer (and not `unanswered`) is still open. */
+  questions?: StepQuestion[];
+  /** Messages a person sent into the running step, as delivered. */
+  messages?: StepMessage[];
   group: number;
   optional: boolean;
   /** Carried from the flow — see FlowStep. Both are resolved at run
@@ -2699,6 +3080,20 @@ export interface StepRecord {
   /** A size class a retry moved the step up to (an evicted or OOM-killed
    *  attempt), overriding the agent's own `size:` for the attempts after. */
   sizeUp?: "large" | "heavy";
+  /** Which runner image the step's sandbox ran: `full` (browsers in it) or
+   *  `slim`, why, and `pod` when a browsing step ran slim and browsed
+   *  through the account's browser pod. The last attempt's; absent where
+   *  the executor has one image (docker, in-process). */
+  image?: { variant: "full" | "slim"; why?: string; pod?: boolean } | null;
+  /** Slim browsing through the account's pod (browser-pod.ts): reconnect
+   *  tries and how many got through; when the pod was lost, why and what
+   *  the step had written by then; and what happened — `fallback` (the
+   *  step had only read and ran again on the full image) or `failure` (it
+   *  had written, so it was not re-run). */
+  browserPod?: (BrowserPodOutcome & { fallback?: string; failure?: string }) | null;
+  /** The slim go a lost browser pod ended, set aside while the step re-runs
+   *  on full; recordAttempt makes it a `lost` row of `tries` and clears it. */
+  podLostTry?: Omit<StepAttempt, "n" | "attempt" | "startedAt"> | null;
   /** When the step actually started and finished executing — not when the
    *  run reached it. A step's events approximate this (first and last), but
    *  a model can think for minutes before its first tool call, and a step
@@ -2725,6 +3120,7 @@ export interface StepRecord {
   schemaPath?: string;
   parallel?: number;
   maxTurns?: number;
+  limits?: Record<string, number>;
   /** The parsed JSON an `output: json` step returned. Kept beside the prose
    *  result rather than instead of it: the reply is still what a person
    *  reads on the run page, and the data is what the next step computes on. */
@@ -2851,6 +3247,20 @@ export interface RunRecord {
    * simply gets its first line — which is still better than a status.
    */
   summary?: string | null;
+  /**
+   * What the run's work concluded, when its summary leads with one of the
+   * four verdict words every desk ends on: GOOD, BAD, QUIET, BLOCKED.
+   *
+   * `status` says whether the machine ran — a step crashed, a budget ran
+   * out. The verdict says what the agents found when it did. They are
+   * different facts: a publisher that checks, sees the wrong change in
+   * front of it and refuses to push has run perfectly, and its run is
+   * `completed`. Until this field, that run was a green tick beside a line
+   * reading BLOCKED (run-mu4sdg8z-1otr, 2026-09-17) — the one outcome a
+   * person most needed to see, drawn as success. Null: the summary does
+   * not lead with a verdict, and the run reads exactly as it always did.
+   */
+  verdict?: Verdict | null;
   /** The flow's per-run `budget:` at the time this run started, so the cap
    *  a run was held to is on its record rather than read from a file that
    *  may since have changed. Null: none. */
@@ -3381,6 +3791,28 @@ export function runFailure(run: RunRecord): { agent: string; reason: string } |
  * runFailure, which puts the reason for a failure on the list for the same
  * reason — the sentence was in the record all along.
  */
+export const VERDICTS = ["GOOD", "BAD", "QUIET", "BLOCKED"] as const;
+export type Verdict = (typeof VERDICTS)[number];
+
+/**
+ * The verdict a headline leads with, or null. Leading, whole-word and
+ * upper-case only — "GOOD — 6 links applied", "**BLOCKED**: nothing
+ * pushed", "BAD: 3 pages dropped". A summary that merely contains the word
+ * ("no BLOCKED items") has no verdict, for the reason markerPresent gives.
+ */
+export function verdictOf(summary: string | null | undefined): Verdict | null {
+  if (!summary) return null;
+  const line = summary.replace(/^[\s#>*_`\-]+/, "");
+  const m = /^(GOOD|BAD|QUIET|BLOCKED)(?![A-Za-z0-9_])/.exec(line);
+  return m ? (m[1] as Verdict) : null;
+}
+
+/** A run's verdict: recorded when it finished, else read from its summary,
+ *  so runs from before the field existed show one too. */
+export function runVerdict(run: Pick<RunRecord, "verdict" | "summary">): Verdict | null {
+  return run.verdict !== undefined ? run.verdict : verdictOf(run.summary);
+}
+
 export function runSummary(run: RunRecord): string | null {
   for (let i = run.steps.length - 1; i >= 0; i--) {
     const line = stepHeadline(run.steps[i]);