@intentic/sandbox-contract 1.344.0 → 1.346.0

package/src/contracts/device.contract.ts

@@ -9,9 +9,16 @@ import { OkSchema } from "../schemas/shared.js";
 import { ProjectDeliveryResultSchema, ProjectDeliverySchema } from "../schemas/project-delivery.js";
 import { DialLoopbackSchema, StageArtifactResultSchema, StageArtifactSchema } from "../schemas/device-artifacts.js";
 import {
+    KeyringCaptureItemSchema,
+    KeyringCaptureResultSchema,
     KeyringCopiesSchema,
     KeyringInboxItemSchema,
     KeyringInboxResultSchema,
+    KeyringNeedResultSchema,
+    KeyringNeedSchema,
+    KeyringPhoneFillResultSchema,
+    KeyringPhoneKeysSchema,
+    KeyringPhonePairResultSchema,
     KeyringReleaseResultSchema,
     KeyringSharesSchema,
     KeyringSyncDeliverResultSchema,
@@ -23,6 +30,7 @@ import {
     KeyringTypeInputSchema,
     KeyringTypeResultSchema,
     SignedKeyringGrantSchema,
+    SignedKeyringPhoneFillSchema,
 } from "../schemas/keyring.js";
 
 // What a connected device can be asked, over the socket it opened; the machine is the oRPC server, the daemon the
@@ -76,4 +84,12 @@ export const deviceContract = {
     keyringSyncPair: oc.input(KeyringSyncPairSchema).output(KeyringSyncPairResultSchema),
     keyringSyncOutbox: oc.output(KeyringSyncOutboxSchema),
     keyringSyncDeliver: oc.input(KeyringSyncDeliverSchema).output(KeyringSyncDeliverResultSchema),
+    // The Passwords app (2026-10-19). A credential seen in this sandbox (a terminal prompt the person typed into) or on
+    // the owner's phone, sealed to the keyring's inbox key: kept when remembering is on for its source.
+    keyringCapture: oc.input(KeyringCaptureItemSchema).output(KeyringCaptureResultSchema),
+    // An agent's need, by where the credential is to be used: the keyring matches, asks the person, and shares.
+    keyringNeed: oc.input(KeyringNeedSchema).output(KeyringNeedResultSchema),
+    // The owner's phone, paired with this computer's keyring and filling its autofill, carried by this sandbox.
+    keyringPhonePair: oc.input(KeyringPhoneKeysSchema).output(KeyringPhonePairResultSchema),
+    keyringPhoneFill: oc.input(SignedKeyringPhoneFillSchema).output(KeyringPhoneFillResultSchema),
 };

package/src/contracts/endpoints.contract.ts

@@ -24,6 +24,9 @@ export const TrialStatusSchema = z.object({
     retryAt: z.string().optional(),
     // The real model that served the last trial message; the published id only names the trial ladder.
     servedModel: z.string().optional(),
+    // Steps a task started while some of the allowance was left may still run today to finish past it (the platform's
+    // turn grace); absent where the platform grants none.
+    grace: z.number().int().nonnegative().optional(),
 });
 export type TrialStatusResponse = z.infer<typeof TrialStatusSchema>;
 

package/src/contracts/push.contract.ts

@@ -1,5 +1,13 @@
 import { procedure } from "../protocol/route-meta.js";
-import { PushChannelIdSchema, PushChannelSchema, PushConfigQuerySchema, PushConfigSchema, PushTestSchema } from "../schemas/push.js";
+import {
+    PushChannelIdSchema,
+    PushChannelSchema,
+    PushConfigQuerySchema,
+    PushConfigSchema,
+    PushSentNotificationSchema,
+    PushSentQuerySchema,
+    PushTestSchema,
+} from "../schemas/push.js";
 import { OkSchema } from "../schemas/shared.js";
 
 // A member's own devices, which no control token reaches.
@@ -11,6 +19,8 @@ const pushRoute = procedure.meta({ control: "never" });
 // automation is waiting for approval. A channel is either a browser's web-push subscription or a native
 // install reached through the platform's push relay, see PushChannelSchema for the split and why.
 //
+// `notification` is the words of one the caller's devices were sent, for a native app whose push carried only its tag.
+//
 // `test` exists because a notification pipeline has four independent failure points the user cannot inspect
 // (device permission, service-worker or shell registration, the daemon's key, the push service itself), a
 // button that proves the whole chain end-to-end is worth more than any amount of status rendering.
@@ -56,4 +66,16 @@ export const pushContract = {
         })
         .meta({ floor: "collaborator" })
         .output(PushTestSchema),
+    // A read at the default viewer floor: the gate is the recipient check in the handler, which answers only what was sent
+    // to the caller's own devices, and answers not found for everything else.
+    notification: pushRoute
+        .route({
+            method: "GET",
+            path: "/push/notification",
+            summary: "What a notification said",
+            description:
+                "The notification this sandbox last sent to your devices under a tag: its words, where it points, and when it went. For a native app whose push carries only the tag, so the words never pass through the push service. Not found once it is no longer kept (the newest 200 tags for a day, never across a restart) and for a tag none of your devices was sent.",
+        })
+        .input(PushSentQuerySchema)
+        .output(PushSentNotificationSchema),
 };

package/src/contracts/secrets.contract.ts

@@ -26,6 +26,7 @@ import {
     SecretRevealSchema,
     SecretSetSchema,
 } from "../schemas/secrets.js";
+import { SandboxNeedsSchema, SandboxPasswordsActivitySchema, SandboxPasswordsSchema, SecretWantResultSchema, SecretWantSchema } from "../schemas/sandbox-passwords.js";
 import { OkSchema } from "../schemas/shared.js";
 
 // Credentials are the operating tier's, reads included: maintainer is the highest revokable grant, and no token's.
@@ -207,6 +208,44 @@ export const secretsContract = {
         .meta({ panel: false })
         .input(SandboxKeyringPairSchema)
         .output(SandboxKeyringPairResultSchema),
+    // An agent's need, by place rather than by name (schemas/sandbox-passwords.ts): the owner's keyrings match it and ask.
+    want: secretRoute
+        .route({
+            method: "POST",
+            path: "/secrets/want",
+            summary: "Ask the owner's computers for a credential by where it is used",
+            description:
+                "Asks each of the owner's computers with Passwords set up, most recently used first, for a credential that works at the place named (a site, a program, an ssh target, a git host). The person there is asked whether this sandbox may use it, and on what terms. Answers the name a reference uses once allowed, or that the answer is awaited in Passwords. Never a value.",
+        })
+        // The `secrets want` CLI and type_secret by place, on the agent token: it asks a person, and hands no value back.
+        .meta({ agent: true })
+        .input(SecretWantSchema)
+        .output(SecretWantResultSchema),
+    passwords: secretRoute
+        .route({
+            method: "GET",
+            path: "/secrets/passwords",
+            summary: "The passwords this sandbox may use",
+            description:
+                "Every entry the keyrings on the owner's computers share with this sandbox, where each works and how this sandbox may use it, and each computer's Passwords state. Names and places only, never values.",
+        })
+        .output(SandboxPasswordsSchema),
+    passwordNeeds: secretRoute
+        .route({
+            method: "GET",
+            path: "/secrets/passwords/needs",
+            summary: "Credentials this sandbox asked for that wait for an answer",
+            description: "The needs this sandbox raised (`secrets want`) that the owner has not answered yet, and on which computer each waits.",
+        })
+        .output(SandboxNeedsSchema),
+    passwordActivity: secretRoute
+        .route({
+            method: "GET",
+            path: "/secrets/passwords/activity",
+            summary: "This sandbox's uses of the owner's passwords",
+            description: "Each time this sandbox used a password one of the owner's keyrings keeps, newest first, from its own use ledger. Never a value.",
+        })
+        .output(SandboxPasswordsActivitySchema),
     // The credential gateway's say over one connection: how its credential reaches the agent, and what it may do there.
     policy: secretRoute
         .route({

package/src/contracts/workspace.contract.ts

@@ -25,6 +25,8 @@ import {
     WorkspaceDerivedQuerySchema,
     WorkspaceDerivedSchema,
     WorkspaceDeletedSchema,
+    WorkspaceDimensionsQuerySchema,
+    WorkspaceDimensionsSchema,
     WorkspaceDirSchema,
     WorkspaceExtractSchema,
     WorkspaceRestoredSchema,
@@ -110,6 +112,20 @@ export const workspaceContract = {
         .meta({ floor: "viewer", guest: true })
         .input(WorkspaceDerivedQuerySchema)
         .output(WorkspaceDerivedSchema),
+    // A folder's pictures measured at once, so a gallery lays out its rows before the pictures themselves arrive. A body,
+    // not a query: the paths are a folder's worth.
+    dimensions: procedure
+        .route({
+            method: "POST",
+            path: "/workspace/dimensions",
+            summary: "Measure pictures and videos",
+            description:
+                "The width and height each picture or video is shown at, and a video's running time, for a list of workspace files. Only the files' headers are read, so a folder's worth costs little; a gallery uses it to lay out its rows before any picture has loaded. A file that is not a picture, or cannot be read, is simply left out.",
+        })
+        // Measuring is reading a file's header, and the answer is a few numbers per file.
+        .meta({ floor: "viewer", guest: true })
+        .input(WorkspaceDimensionsQuerySchema)
+        .output(WorkspaceDimensionsSchema),
     // Mints the ticket GET /workspace/media (a plain Hono byte-range route, no oRPC shape) requires to stream.
     mediaTicket: procedure
         .route({

package/src/events/agent-events.ts

@@ -8,7 +8,8 @@ import { FastModeStateSchema } from "../schemas/providers/fast-mode.js";
 import { NeedSchema } from "../schemas/needs.js";
 import { PromptCacheOpeningSchema, PromptFingerprintSchema } from "../schemas/keep-warm.js";
 import { AgentReplySchema, UsageWindowSchema } from "../schemas/providers/plan-limits.js";
-import { SubagentKindSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
+import { PrivacyBypassSchema } from "../schemas/privacy-egress.js";
+import { SubagentKindSchema, SubagentSdkRecordSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
 import { RetryLadderSchema } from "../schemas/turn-break.js";
 import { HandedOffSchema, HandoffOfferSchema } from "../schemas/providers/handoff.js";
 import { AgentCommandSchema, browserHelpRequest, capabilityOfferRequest, CapabilityOutcomeSchema, ContextUsageSchema, credentialOfferRequest, CredentialReceiptSchema, pageAskRequest, PageSchema, paymentOfferRequest, PaymentReceiptSchema, PermissionRequestSchema, PlanRequestSchema, QuestionRequestSchema, terminalHelpRequest, TodoItemSchema, ToolCallContentSchema, ToolCallLocationSchema, ToolCallStatusSchema, ToolKindSchema } from "./requests.js";
@@ -19,6 +20,87 @@ import { agentNoticeEvent, agentStatusEvent } from "./agent-ui.js";
 // Every frame an agent turn streams, as one `kind`-discriminated union: turn facts (session, standing, cost) and the
 // attach stream a window joins through. One closed vocabulary, kept in one file.
 
+// What a failure is, by name: the one vocabulary every runtime's failure is read into at its boundary (a runtime's typed
+// error, or the shared reading of its words), and the one a reader draws a failure's line from. A failure none of these
+// names goes out with no code: the unclassified kind, said as such, never a guess.
+export const AgentErrorCodeSchema = z.enum([
+    "session-not-found",
+    "rate_limit",
+    // Codex ran the turn but warned about it (fallback model metadata); a notice, not a failure.
+    "codex-advisory",
+    "codex-reauth",
+    // An ACP capability requires its own loginCommand, not a native provider account reconnect.
+    "acp-auth-required",
+    // The Claude subscription credential is dead; only a reconnect fixes it, unlike no account connected.
+    "claude-reauth",
+    // The API refused this turn's token mid-flight, usually superseded by a rotation already re-minting.
+    "claude-token-refused",
+    // The account authenticates and has real usage pools, but the org disabled Claude Code for this seat.
+    "claude-not-entitled",
+    // Any other provider's account signs in but is refused service outright, for every model (Cursor's
+    // `[role_forbidden]` for a non-billable admin): filed against the account, so placement skips it.
+    "account-not-entitled",
+    // The provider failed transiently and in-turn retries did not outlast it; the daemon retries on
+    // backoff.
+    "provider-outage",
+    // The platform-owned free-trial pool failed after its bounded key walk; the failed call is refunded.
+    "trial-unavailable",
+    // The trial answered, but the selected upstream model/request cannot run through this sandbox.
+    "trial-model-unavailable",
+    // This account's platform-owned daily trial allowance is spent until its UTC reset.
+    "trial-exhausted",
+    // The harness read the message as a slash command it doesn't have; the model never saw it.
+    "unknown-command",
+    "grok-model-invalid",
+    "codex-model-invalid",
+    // The model is real and listed, but this plan's subscription does not have access to it.
+    "model-unavailable",
+    // The model cannot hold a turn this size, refused before sending; retrying the same request never
+    // helps.
+    "context-window-too-small",
+    // The model can only write one-shot jobs (Model.helperOnly: its server says it cannot call tools, or
+    // it is the quick-jobs local model), refused before sending; the words wait for another model.
+    "model-helper-only",
+    // The privacy shield is on, the provider is untrusted, and the runtime is one it cannot read by content at
+    // all (an ACP agent, Pi), refused before sending; the words wait for a covered provider.
+    "privacy-unshielded",
+    // The turn carries a tool list (an automation's `allowedTools`) and its runtime cannot keep one
+    // (AgentCapabilities.toolAllowlist), refused before sending; the words wait for a runtime that can.
+    "tools-unenforced",
+    // The protected execution-domain policy is unsupported or unreadable; refused before any model/helper ran.
+    "agent-domain-refused",
+    // The privacy shield found personal data in instructions the runtime loads itself, past every channel it
+    // could mask (Cursor's project rules, AGENTS.md), refused before sending; the words wait for the owner to
+    // let the provider read this conversation, trust it, or take the data out of those files.
+    "privacy-instructions",
+    // The session outgrew the model's context window mid-turn; resuming that session only overflows again,
+    // so the daemon re-runs the turn once in a fresh session carrying the hand-off.
+    "context-overflow",
+    "subscription-required",
+    "agent-busy",
+    // The sandbox is short of memory, held before anything spawned: a person once per spell, after which
+    // their sends run; background work on every short reading. Transient, no clock.
+    "sandbox-memory-low",
+    // The conversation's own view of the workspace (its mount namespace) did not come up in time, twice,
+    // before anything ran: the sandbox too loaded to set it up. Held like a memory hold, and sent again by
+    // itself once the sandbox has had room for a while (the memory wall's answer).
+    "workspace-setup",
+    // The history volume cannot fit a new conversation checkout while keeping its free-space floor.
+    "sandbox-disk-low",
+    // The runtime hit its own iteration ceiling and stopped; the work may be half done, so the user
+    // decides.
+    "turn-cap",
+    // The harness ended the turn without succeeding, with no modelled reason; the vendor's subtype rides
+    // verbatim.
+    "harness-incomplete",
+    // The installed engine is too old for the model; the provider names the version required, on `engine`.
+    "engine-version-floor",
+    // The provider's safety classifier stopped the turn partway, often a false positive on ordinary work.
+    // Held for a person: retry on the same model without the stopped response, or go on with another.
+    "safeguard-flagged",
+]);
+export type AgentErrorCode = z.infer<typeof AgentErrorCodeSchema>;
+
 // One frame per emission, `kind`-discriminated; the daemon maps SDK message types onto this closed set, dropping any
 // without a UI mapping. `plan`/`question`/`permission` pause until `resolved` names the same requestId.
 export const AgentEventSchema = z.discriminatedUnion("kind", [
@@ -142,6 +224,9 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
         error: z.string().optional(),
         // Whether anything checked the work this report describes; rides the frame that ends the child.
         verification: SubagentVerificationSchema.optional(),
+        // Where the Claude runtime keeps an in-process child's own record, said once the daemon has paired it, so the
+        // card the turn settles into can name it after a restart.
+        sdk: SubagentSdkRecordSchema.optional(),
     }),
     z.object({ kind: z.literal("todos"), items: z.array(TodoItemSchema) }),
     // The provider's own slash commands, replaced whole each time; the composer's `/` popover lists them, invoking one
@@ -268,84 +353,13 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("error"),
         message: z.string(),
-        code: z
-            .enum([
-                "session-not-found",
-                "rate_limit",
-                // Codex ran the turn but warned about it (fallback model metadata); a notice, not a failure.
-                "codex-advisory",
-                "codex-reauth",
-                // An ACP capability requires its own loginCommand, not a native provider account reconnect.
-                "acp-auth-required",
-                // The Claude subscription credential is dead; only a reconnect fixes it, unlike no account connected.
-                "claude-reauth",
-                // The API refused this turn's token mid-flight, usually superseded by a rotation already re-minting.
-                "claude-token-refused",
-                // The account authenticates and has real usage pools, but the org disabled Claude Code for this seat.
-                "claude-not-entitled",
-                // Any other provider's account signs in but is refused service outright, for every model (Cursor's
-                // `[role_forbidden]` for a non-billable admin): filed against the account, so placement skips it.
-                "account-not-entitled",
-                // The provider failed transiently and in-turn retries did not outlast it; the daemon retries on
-                // backoff.
-                "provider-outage",
-                // The platform-owned free-trial pool failed after its bounded key walk; the failed call is refunded.
-                "trial-unavailable",
-                // The trial answered, but the selected upstream model/request cannot run through this sandbox.
-                "trial-model-unavailable",
-                // This account's platform-owned daily trial allowance is spent until its UTC reset.
-                "trial-exhausted",
-                // The harness read the message as a slash command it doesn't have; the model never saw it.
-                "unknown-command",
-                "grok-model-invalid",
-                "codex-model-invalid",
-                // The model is real and listed, but this plan's subscription does not have access to it.
-                "model-unavailable",
-                // The model cannot hold a turn this size, refused before sending; retrying the same request never
-                // helps.
-                "context-window-too-small",
-                // The model can only write one-shot jobs (Model.helperOnly: its server says it cannot call tools, or
-                // it is the quick-jobs local model), refused before sending; the words wait for another model.
-                "model-helper-only",
-                // The privacy shield is on, the provider is untrusted, and the runtime is one it cannot read by content at
-                // all (an ACP agent, Pi), refused before sending; the words wait for a covered provider.
-                "privacy-unshielded",
-                // The turn carries a tool list (an automation's `allowedTools`) and its runtime cannot keep one
-                // (AgentCapabilities.toolAllowlist), refused before sending; the words wait for a runtime that can.
-                "tools-unenforced",
-                // The protected execution-domain policy is unsupported or unreadable; refused before any model/helper ran.
-                "agent-domain-refused",
-                // The privacy shield found personal data in instructions the runtime loads itself, past every channel it
-                // could mask (Cursor's project rules, AGENTS.md), refused before sending; the words wait for the owner to
-                // let the provider read this conversation, trust it, or take the data out of those files.
-                "privacy-instructions",
-                // The session outgrew the model's context window mid-turn; resuming that session only overflows again,
-                // so the daemon re-runs the turn once in a fresh session carrying the hand-off.
-                "context-overflow",
-                "subscription-required",
-                "agent-busy",
-                // The sandbox is short of memory, held before anything spawned: a person once per spell, after which
-                // their sends run; background work on every short reading. Transient, no clock.
-                "sandbox-memory-low",
-                // The conversation's own view of the workspace (its mount namespace) did not come up in time, twice,
-                // before anything ran: the sandbox too loaded to set it up. Held like a memory hold, and sent again by
-                // itself once the sandbox has had room for a while (the memory wall's answer).
-                "workspace-setup",
-                // The history volume cannot fit a new conversation checkout while keeping its free-space floor.
-                "sandbox-disk-low",
-                // The runtime hit its own iteration ceiling and stopped; the work may be half done, so the user
-                // decides.
-                "turn-cap",
-                // The harness ended the turn without succeeding, with no modelled reason; the vendor's subtype rides
-                // verbatim.
-                "harness-incomplete",
-                // The installed engine is too old for the model; the provider names the version required, on `engine`.
-                "engine-version-floor",
-                // The provider's safety classifier stopped the turn partway, often a false positive on ordinary work.
-                // Held for a person: retry on the same model without the stopped response, or go on with another.
-                "safeguard-flagged",
-            ])
-            .optional(),
+        // Who worded `message`. Absent, it is the provider's or the harness's own words, which a reader keeps behind a
+        // press and leads with a line of its own for the code: nothing the sandbox forgot to mark is ever a raw headline.
+        own: z
+            .boolean()
+            .optional()
+            .describe("The message is the sandbox's own sentence, fit to be the notice's line. Absent, it is what the provider or the harness said."),
+        code: AgentErrorCodeSchema.optional(),
         // safeguard-flagged only: what the classifier named, and where a retry resumes the session from.
         refusal: z
             .object({
@@ -356,6 +370,12 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
                     .describe("The last session entry before the stopped response: a retry resumes the session there, so the model never sees what was stopped."),
             })
             .optional(),
+        // A privacy refusal only: the route the shield's verdict refused (shieldVerdict's `refuse.route`), typed, so a
+        // reader acts on where the bytes would have gone rather than on the sentence. Absent for a policy that could
+        // not be read, which refuses whatever the route.
+        privacyRoute: PrivacyBypassSchema.optional().describe(
+            "Where the bytes would have gone past the privacy shield: a runtime it cannot read, a runner calling its provider from its own machine, the container's own key, or a shared server started before the shield was on.",
+        ),
         // Which engine, the version refused, and the floor the provider requires; lets the client offer an install.
         engine: z
             .object({

package/src/events/agent-transcript.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { AgentHarnessSchema, AgentProviderSchema } from "../schemas/agent.js";
+import { SessionTranscriptSchema, TurnEndingSchema } from "./transcript.js";
+
+// The record a reopened tab rebuilds from: messages plus what the session is bound to (provider, runtime, account). A
+// client can't derive these: after a mid-chat switch, its own picks belong to a different session.
+export const AgentTranscriptSchema = SessionTranscriptSchema.extend({
+    sessionId: z.string().optional().describe("The provider session behind the last turn, when there is one."),
+    provider: AgentProviderSchema.optional().describe("Which provider minted that session."),
+    harness: AgentHarnessSchema.optional().describe("Which runtime minted it: a session resumes only on the loop that opened it."),
+    account: z
+        .string()
+        .optional()
+        .describe("Which stored account it belongs to, as the daemon resolved it. Absent when no stored account paid for the turn."),
+    // How the last turn ended, for endings that leave a live session with just a press to offer; absent otherwise.
+    ending: TurnEndingSchema.optional().describe(
+        "How the last turn ended, when it left work behind that one press finishes. Absent for a conversation whose last turn ended on its own, and for the failures that name something to repair first.",
+    ),
+    // `from` offsets every `rewindIndex` here, and is the `before` for the page above; `more` flags older messages.
+    from: z
+        .number()
+        .int()
+        .nonnegative()
+        .describe("Where the first message sits in the whole record, and the `before` that asks for the page above this one."),
+    more: z.boolean().describe("Whether older messages precede this page."),
+    // The cursor a reader keeps between reads: `through` (with the id of the row just before it) is the `after` of its
+    // next read, which then carries only what the record gained since.
+    through: z
+        .number()
+        .int()
+        .nonnegative()
+        .optional()
+        .describe(
+            "The position just past this page's last message: pass it back as `after`, with that message's `rowId` as `afterRow`, to read only what the record gains from here on. Absent from a sandbox older than reading forward.",
+        ),
+    continuous: z
+        .boolean()
+        .optional()
+        .describe(
+            "Answered to a read with `after`: true when these messages carry on exactly from there, to be added to what the reader holds; false when the record no longer runs through that point (a rewind since, or more written than one page carries), so this is its latest page instead, to replace what the reader holds.",
+        ),
+    live: z
+        .string()
+        .optional()
+        .describe(
+            "The run going on in this conversation right now, which the record does not hold yet: attach to it for its rows as they are drawn. Absent when nothing runs.",
+        ),
+});

package/src/events/agent-words.ts

@@ -48,8 +48,20 @@ export interface ChildReportFields {
     // Where its work went, in the daemon's words: into the parent's own checkout, or held off it by a clash. Undefined
     // for a child whose work lands as any conversation's does.
     readonly landing?: string | undefined;
+    // For a child spawned with a result schema: the value it handed back, written out as JSON, or why it handed none.
+    readonly result?: { readonly json: string } | { readonly missing: string } | undefined;
 }
 
+// The result a child spawned with a schema handed back, in words; nothing for a child spawned without one.
+const resultLines = (result: ChildReportFields["result"]): readonly string[] => {
+    if (result === undefined) {
+        return [];
+    }
+    return "json" in result
+        ? ["", "Result (it matches the schema you gave it):", "```json", result.json, "```"]
+        : ["", `Result: none. ${result.missing} Ask it for one with send.`];
+};
+
 // The wait tool's `verification` field, in words.
 const verificationLine = (verification: SubagentVerification | undefined): string | undefined => {
     if (verification === undefined) {
@@ -76,6 +88,7 @@ export const childReportPrompt = (fields: ChildReportFields): string => {
         ...(verification === undefined ? [] : [verification]),
         "",
         fields.report.trim() === "" ? "(It ended without a closing report.)" : fields.report.trim(),
+        ...resultLines(fields.result),
         "",
         `${fields.landing ?? "Its changes are in its own worktree and land the way any agent's do."} Its account of its own work is a claim, not ` +
             "a result: check what matters before you build on it, and follow up with the subagents tools as you would mid-turn.",

package/src/events/failure-rows.ts

@@ -0,0 +1,148 @@
+import type { AgentEvent } from "./agent-events.js";
+import { type FailureSaid, type NoticeCode, noticeCode } from "./sandbox-notice.js";
+import type { TranscriptRow } from "./transcript.js";
+import { anotherModelClears, turnedAwayCode } from "../policy/turned-away.js";
+
+/* EVERY ROW A FAILURE LEAVES, in one place: the fold's one way from an `error` frame to a notice. Each row is coded,
+   whatever the frame carried, so no reader ever has to guess from a row's words whether it is a failure, or what kind:
+   a failure nobody named is `failed` with no `error`, the unclassified kind, never bare text (2026-10-20: a week of
+   transcripts held 105 failure rows written as bare provider words, a spent allowance's among them, against 34 coded). */
+
+type ErrorFrame = Extract<AgentEvent, { kind: "error" }>;
+type FailureRow = TranscriptRow & { readonly noticeCode: NoticeCode };
+
+// A failure's own sentence, its code and who worded it, which every failure row carries ahead of the clause it adds.
+const failureOf = (event: ErrorFrame): FailureSaid => ({ message: event.message, error: event.code, own: event.own === true ? true : undefined });
+
+const failedRow = (event: ErrorFrame): FailureRow => ({
+    role: "notice",
+    text: event.message,
+    noticeCode: noticeCode({ code: "failed", params: failureOf(event) }),
+});
+
+// The row a refusal that ran nothing leaves when the conversation's queue holds the words (heldRow). A turn somebody typed
+// is held in its conversation's queue for another press; a turn that started itself (an automation, a loop, a watch wake)
+// has no typed message and nobody watching, so promising a resend there names a composer the reader is not looking at.
+// Neither version promises a retry: whether one comes is the scheduler's decision, not this row's to state.
+const undeliveredRow = (said: FailureSaid, unattended: boolean): FailureRow => ({
+    role: "notice",
+    text: unattended
+        ? `${said.message} Nothing ran, and nothing is held: this run started on its own, so there is no message waiting to be sent again.`
+        : `${said.message} Your message was not delivered: it is held for you to send again.`,
+    noticeCode: noticeCode({ code: "undelivered", params: { ...said, unattended: unattended || undefined } }),
+});
+
+// The row the same refusal leaves once the turn had already run: a trial spent, or a model refused, on a later step. The
+// message was read and acted on, so it is neither undelivered nor held (turn-runs keeps only a turn turned away at the
+// door), and saying so invited a resend of something that had already changed files (onboarding review 2026-10-18,
+// F07). What it did stays in the conversation's copy; the press, when another model gets past the refusal, carries on there.
+const stoppedPartwayRow = (said: FailureSaid, switchModel: boolean): FailureRow => {
+    const row: FailureRow = {
+        role: "notice",
+        text: switchModel
+            ? `${said.message} The run stopped partway. The changes it made so far are kept: continue with another model to pick up from here.`
+            : `${said.message} The run stopped partway. The changes it made so far are kept: send a message to pick up from here.`,
+        noticeCode: noticeCode({ code: "stoppedPartway", params: { ...said, switchModel: switchModel || undefined } }),
+    };
+    if (switchModel) {
+        row.noticeAction = "switchModel";
+    }
+    return row;
+};
+
+// The press a memory hold offers: the raise rides along only when the hold carried a ceiling to size it by, since a
+// stall names none and raising one would not clear it.
+const memoryPress = (event: ErrorFrame): "sendAnyway" | "sandboxMemory" => (event.memory === undefined ? "sendAnyway" : "sandboxMemory");
+
+// A memory hold is asked once and never again that spell (resource-budget.ts), so the next send always runs. A turn the
+// sandbox started itself (a fix press, a peer's message, a re-run) was never in a composer: its message stays above, and
+// the press asks the sandbox to run the turn it kept rather than sending a queue that holds nothing.
+const heldRow = (event: ErrorFrame): FailureRow => {
+    const unattended = event.unattended === true;
+    const memory = event.code === "sandbox-memory-low";
+    const said = failureOf(event);
+    if (event.held !== undefined && !unattended) {
+        return {
+            role: "notice",
+            text: memory
+                ? `${event.message} Nothing has run yet: the message above is kept here, and sending it anyway starts it.`
+                : `${event.message} Nothing has run yet: the message above is kept here to send again once that is sorted.`,
+            noticeAction: memory ? memoryPress(event) : "sendAgain",
+            sandboxHeld: true,
+            noticeCode: noticeCode({ code: "kept", params: { ...said, memory: memory || undefined } }),
+        };
+    }
+    if (!memory || unattended) {
+        return undeliveredRow(said, unattended);
+    }
+    return {
+        role: "notice",
+        text: `${event.message} Your message is held: send it again to start anyway.`,
+        noticeAction: memoryPress(event),
+        noticeCode: noticeCode({ code: "memoryHeld", params: said }),
+    };
+};
+
+// What an armed credential renewal promises, and what its row says instead once a later failure in the same run took
+// that promise back (TranscriptFold.withdrawRenewal).
+export const RENEWING = "The credential is being renewed and this turn continues automatically.";
+export const RENEWAL_WITHDRAWN =
+    "The credential was being renewed, but the turn stopped before it could continue: it will not carry on by itself, so press Continue to pick it back up.";
+
+// What a laddered wall's automatic re-runs are doing, said on the failure's own row so the count stays in the record.
+const retryClause = (event: ErrorFrame): { text: string; code: NoticeCode } | undefined => {
+    const { retries } = event;
+    if (retries === undefined) {
+        return undefined;
+    }
+    const said = failureOf(event);
+    if (event.autoResume === "scheduled") {
+        return {
+            text: `Retrying by itself: attempt ${retries.made + 1} of ${retries.max}.`,
+            code: noticeCode({ code: "retrying", params: { ...said, attempt: retries.made + 1, of: retries.max } }),
+        };
+    }
+    return retries.made >= retries.max
+        ? {
+              text: `Retried ${retries.made} of ${retries.max} times by itself; nothing more is sent automatically.`,
+              code: noticeCode({ code: "retried", params: { ...said, made: retries.made, of: retries.max } }),
+          }
+        : undefined;
+};
+
+/** The row a turn-ending failure leaves: its own sentence plus one clause on what happens next, coded whatever it was.
+ *  The live wait itself is drawn by the chat, not stored here. `ran`: an assistant row stands, so a door refusal stopped
+ *  the turn partway. */
+export const errorRow = (event: ErrorFrame, ran: boolean): FailureRow => {
+    const { message, code } = event;
+    const said = failureOf(event);
+    if (code === "provider-outage") {
+        const retry = retryClause(event);
+        return retry === undefined
+            ? {
+                  role: "notice",
+                  text: `${message} Nothing is retrying it, so the turn is waiting here.`,
+                  noticeCode: noticeCode({ code: "outageWaiting", params: said }),
+              }
+            : { role: "notice", text: `${message} ${retry.text}`, noticeCode: retry.code };
+    }
+    if (code === "claude-token-refused") {
+        return event.autoResume === "scheduled"
+            ? {
+                  role: "notice",
+                  text: `${message} ${RENEWING}`,
+                  noticeWait: "credentialRenewal",
+                  noticeCode: noticeCode({ code: "renewing", params: said }),
+              }
+            : {
+                  role: "notice",
+                  text: `${message} Reconnect the account to pick this conversation back up.`,
+                  noticeCode: noticeCode({ code: "reconnect", params: said }),
+              };
+    }
+    if (!turnedAwayCode(code)) {
+        const retry = retryClause(event);
+        return retry === undefined ? failedRow(event) : { role: "notice", text: `${message} ${retry.text}`, noticeCode: retry.code };
+    }
+    return ran && event.held === undefined ? stoppedPartwayRow(said, anotherModelClears(code)) : heldRow(event);
+};