diff --git a/apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx b/apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx
index 3835925ca00..7e52d9225b7 100644
--- a/apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx
+++ b/apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx
@@ -181,6 +181,7 @@ See [Observability](/platform/self-hosting/observability).
 | `NEXT_PUBLIC_CHAT_DISABLED` | Set to `true` to hide the Chat module: the workspace lands on your first workflow, with no chats list, scheduled tasks, or editor Chat panel. Chat is shown when unset; `bun run setup` sets it for you if you skip the chat key |
 | `PII_REDACTION` | Redact PII from workflow logs via Data Retention rules; requires the PII service and a cluster-reachable `INTERNAL_API_BASE_URL` |
 | `PII_GRANULAR_REDACTION` | Additionally expose the execution-altering redaction stages |
+| `DURABLE_SECRET_PROVENANCE_ENFORCED_SURFACES` | Durable stores where a value whose secret provenance was never recorded fails the run instead of logging a warning. `all`, or a comma-separated subset of `memory`, `table-row`, `knowledge`. Unset (nothing enforced) by default |
 | `ADMIN_API_KEY` | Admin API key for GitOps operations and organization provisioning |
 
 ## Enterprise Features
diff --git a/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/constants.ts b/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/constants.ts
index 31675b86ec0..4b49af2d50b 100644
--- a/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/constants.ts
+++ b/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/constants.ts
@@ -1,8 +1,9 @@
 import type { NavMenu } from '@/app/(landing)/components/navbar/components/nav-menu-chip/types'
 
 /**
- * The Platform menu - Sim's modules. Six items in a three-column grid. Each
- * description names the outcome the module unlocks for your agents.
+ * The Platform menu - Sim's modules. Five items in a three-column grid, so the
+ * bottom-right cell is empty. Each description names the outcome the module
+ * unlocks for your agents.
  */
 export const PLATFORM_MENU: NavMenu = {
   label: 'Platform',
diff --git a/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/nav-menu-chip.tsx b/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/nav-menu-chip.tsx
index f0d71450684..0d0954ef438 100644
--- a/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/nav-menu-chip.tsx
+++ b/apps/sim/app/(landing)/components/navbar/components/nav-menu-chip/nav-menu-chip.tsx
@@ -31,11 +31,9 @@ import type { NavMenu } from '@/app/(landing)/components/navbar/components/nav-m
  * `--surface-4` ring (`p-[3px]`, overlay shadow) wrapping an inner `--bg`
  * surface, with the item grid padded inside.
  *
- * The grid renders three visual columns on six tracks (each tile spans two),
- * which keeps six-item menus pixel-identical to a plain three-column grid while
- * letting a five-item menu center its two-tile last row - the second-to-last
- * tile starts on track two, so the short row sits symmetrically instead of
- * leaving a hole in the corner.
+ * The grid is a plain three-column grid filled in reading order, so a menu with
+ * a non-multiple-of-three item count leaves its gap in the bottom-right corner
+ * rather than centering the short row.
  */
 
 interface NavMenuChipProps {
@@ -81,14 +79,7 @@ export function NavMenuChip({ menu }: NavMenuChipProps) {
       <div className={cn(PANEL_BASE, !closed && PANEL_REVEAL)}>
         <div className='w-[840px] rounded-xl border border-[var(--border-muted)] bg-[var(--surface-4)] p-[3px] shadow-[var(--shadow-overlay)]'>
           <div className='rounded-lg border border-[var(--border-1)] bg-[var(--bg)] p-2'>
-            <div
-              className={cn(
-                'grid grid-cols-6 gap-1 [&>*]:col-span-2',
-                items.length % 3 === 2 && '[&>*:nth-last-child(2)]:col-start-2'
-              )}
-              role='group'
-              aria-label={label}
-            >
+            <div className='grid grid-cols-3 gap-1' role='group' aria-label={label}>
               {items.map((item) => (
                 <NavMenuItem key={item.title} item={item} onSelect={handleSelect} />
               ))}
diff --git a/apps/sim/app/_shell/providers/posthog-provider.tsx b/apps/sim/app/_shell/providers/posthog-provider.tsx
index b127ba6c488..368bb3fc913 100644
--- a/apps/sim/app/_shell/providers/posthog-provider.tsx
+++ b/apps/sim/app/_shell/providers/posthog-provider.tsx
@@ -3,7 +3,7 @@
 import { useEffect, useRef, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import type { PostHog } from 'posthog-js'
-import { getEnv, isTruthy } from '@/lib/core/config/env'
+import { getEnv, isTruthy, publicEnvMissingAtModuleInit } from '@/lib/core/config/env'
 
 const logger = createLogger('PostHogProvider')
 
@@ -49,6 +49,9 @@ export function PostHogProvider({ children }: { children: React.ReactNode }) {
             persistence: 'localStorage+cookie',
           })
         }
+        if (publicEnvMissingAtModuleInit) {
+          posthog.capture('runtime_env_missing_at_module_init')
+        }
         clientRef.current = posthog
         setProvider(() => PHProvider)
       })
diff --git a/apps/sim/app/_shell/public-env-script.test.tsx b/apps/sim/app/_shell/public-env-script.test.tsx
index 6bef6d894c9..7eb6aadf3ec 100644
--- a/apps/sim/app/_shell/public-env-script.test.tsx
+++ b/apps/sim/app/_shell/public-env-script.test.tsx
@@ -1,30 +1,29 @@
 /**
  * @vitest-environment node
  */
-import { EnvScript } from 'next-runtime-env'
+import { renderToStaticMarkup } from 'react-dom/server'
 import { describe, expect, it } from 'vitest'
 import { PublicEnvScript } from '@/app/_shell/public-env-script'
 
 /**
- * Guards the loading strategy, not the markup. A plain `<script>` rendered from
- * the root layout lands after the `<script async>` chunk tags Next emits at the
- * top of the document, so a chunk can execute - and hydration can begin - before
- * `window.__ENV` is populated. Delegating to `<EnvScript>` keeps the
- * `beforeInteractive` guarantee that `next-runtime-env` applies by default.
+ * Guards the one property that matters: the emitted tag assigns `window.__ENV`
+ * itself. Next's `beforeInteractive` strategy instead pushes the assignment onto
+ * `self.__next_s`, a queue `appBootstrap` reads exactly once and abandons when it
+ * is empty - so whenever the bootstrap chunk runs before the parser reaches this
+ * tag, the assignment is discarded and `window.__ENV` is never defined for that
+ * document. See the component's TSDoc for the full ordering argument.
  */
 describe('PublicEnvScript', () => {
-  it('delegates to next-runtime-env EnvScript rather than emitting a raw script tag', () => {
-    const element = PublicEnvScript()
+  it('emits a script that assigns window.__ENV directly', () => {
+    const markup = renderToStaticMarkup(<PublicEnvScript />)
 
-    expect(element.type).toBe(EnvScript)
-    expect(element.type).not.toBe('script')
+    expect(markup).toContain("window['__ENV'] =")
   })
 
-  it('does not opt out of the beforeInteractive strategy', () => {
-    const { disableNextScript, nextScriptProps } = PublicEnvScript().props
+  it('does not defer the assignment into the __next_s queue', () => {
+    const markup = renderToStaticMarkup(<PublicEnvScript />)
 
-    expect(disableNextScript).toBeUndefined()
-    expect(nextScriptProps?.strategy ?? 'beforeInteractive').toBe('beforeInteractive')
+    expect(markup).not.toContain('__next_s')
   })
 
   it('passes only NEXT_PUBLIC_ variables through to the browser', () => {
diff --git a/apps/sim/app/_shell/public-env-script.tsx b/apps/sim/app/_shell/public-env-script.tsx
index fa0aebc0d96..b2ff7b0f58e 100644
--- a/apps/sim/app/_shell/public-env-script.tsx
+++ b/apps/sim/app/_shell/public-env-script.tsx
@@ -18,21 +18,31 @@ const HOSTED_PUBLIC_ENV = Object.fromEntries(
 /**
  * Static equivalent of `next-runtime-env`'s `<PublicEnvScript>` for the hosted
  * deployment. It renders the library's own `<EnvScript>`, so the emitted markup
- * and its `beforeInteractive` loading strategy are identical to the self-hosted
- * path - only the env read differs. `<PublicEnvScript>` additionally calls
- * `unstable_noStore()`, which opts the entire app into dynamic rendering; that
- * only pays off for self-hosted Docker images that re-inject env per deploy
- * without a rebuild, so hosted reads the env once here and stays static.
+ * is identical to the self-hosted path - only the env read differs.
+ * `<PublicEnvScript>` additionally calls `unstable_noStore()`, which opts the
+ * entire app into dynamic rendering; that only pays off for self-hosted Docker
+ * images that re-inject env per deploy without a rebuild, so hosted reads the
+ * env once here and stays static.
  *
- * `beforeInteractive` is load-bearing, not an optimization. A plain `<script>`
- * rendered from the root layout lands at the end of `<head>`, after the ~40
- * `<script async>` chunk tags Next emits at the top of the document; an `async`
- * script runs as soon as its fetch resolves, so on a warm cache a Next chunk
- * can execute - and hydration can begin - before the parser reaches the env
- * tag, leaving `window.__ENV` undefined for the first render.
- * `beforeInteractive` instead queues the script into `self.__next_s`, which
- * Next's `appBootstrap` drains to completion before calling `hydrate()`.
+ * `disableNextScript` is load-bearing. Without it, `<EnvScript>` defaults to
+ * Next's `<Script strategy='beforeInteractive'>`, which does not assign
+ * `window.__ENV` at all - it emits a tag that pushes the assignment onto
+ * `self.__next_s`. That queue has exactly one consumer, `appBootstrap`, which
+ * reads it once and short-circuits to `hydrate()` when it is empty. The
+ * bootstrap chunk's `<script async>` tag sits ~13KB earlier in the document
+ * than this tag, so whenever that chunk executes before the parser arrives
+ * here, the queue is drained empty, nothing ever drains it again, and
+ * `window.__ENV` stays undefined for the entire lifetime of the document -
+ * every `getEnv` read empty, until a reload happens to win the race.
+ *
+ * A plain `<script>` assigns unconditionally when the parser reaches it. When
+ * it is reached before the bootstrap chunk runs it lands strictly earlier than
+ * the queue drain would have; when it is not, the value still arrives a few
+ * milliseconds late instead of never. There is no supported way to place an
+ * inline script ahead of the framework's own bootstrap tags - React emits those
+ * in the preamble, before any content from the component tree - so the goal is
+ * to make losing that race harmless rather than to try to win it.
  */
 export function PublicEnvScript() {
-  return <EnvScript env={HOSTED_PUBLIC_ENV} />
+  return <EnvScript env={HOSTED_PUBLIC_ENV} disableNextScript />
 }
diff --git a/apps/sim/app/api/guardrails/validate/route.test.ts b/apps/sim/app/api/guardrails/validate/route.test.ts
index 5ae3dbe996a..797e7852af0 100644
--- a/apps/sim/app/api/guardrails/validate/route.test.ts
+++ b/apps/sim/app/api/guardrails/validate/route.test.ts
@@ -244,6 +244,7 @@ describe('POST /api/guardrails/validate', () => {
     expect(res.status).toBe(200)
     expect(mockImportProvenance).toHaveBeenCalledWith(provenance, 'secret value', ['input'], {
       trusted: true,
+      origin: 'guardrailsRoute.inputProvenance',
     })
   })
 
diff --git a/apps/sim/app/api/guardrails/validate/route.ts b/apps/sim/app/api/guardrails/validate/route.ts
index f0e50dcfa9d..d6edea5b4ef 100644
--- a/apps/sim/app/api/guardrails/validate/route.ts
+++ b/apps/sim/app/api/guardrails/validate/route.ts
@@ -267,7 +267,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
                 provenanceInspection.value,
                 inputStr,
                 ['input'],
-                { trusted: true }
+                { trusted: true, origin: 'guardrailsRoute.inputProvenance' }
               )
             ).success
           : true
diff --git a/apps/sim/app/api/knowledge/search/route.ts b/apps/sim/app/api/knowledge/search/route.ts
index c4c412df787..e0530f6b772 100644
--- a/apps/sim/app/api/knowledge/search/route.ts
+++ b/apps/sim/app/api/knowledge/search/route.ts
@@ -604,7 +604,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         !(await importDurableSecretProvenance(
           resultSecretRegistry,
           metadata.provenance,
-          renderedMetadata
+          renderedMetadata,
+          'knowledge'
         ))
       ) {
         resultSecretRegistry.markIncomplete()
diff --git a/apps/sim/app/api/mcp/serve/[serverId]/route.ts b/apps/sim/app/api/mcp/serve/[serverId]/route.ts
index 211edf1305b..ee7cea60c34 100644
--- a/apps/sim/app/api/mcp/serve/[serverId]/route.ts
+++ b/apps/sim/app/api/mcp/serve/[serverId]/route.ts
@@ -288,6 +288,7 @@ async function projectWorkflowMcpModelContent(
 ): Promise<unknown> {
   const registry = new ResolvedSecretTraceRegistry([], scope)
   const imported = await registry.importCrossingProvenance(privateProvenance, value, {
+    origin: 'mcpServe.workflowCrossing',
     trusted: true,
   })
   if (!imported || !registry.isComplete()) {
diff --git a/apps/sim/app/api/memory/secret-provenance.ts b/apps/sim/app/api/memory/secret-provenance.ts
index dc6ea8f7368..cd14e84b90d 100644
--- a/apps/sim/app/api/memory/secret-provenance.ts
+++ b/apps/sim/app/api/memory/secret-provenance.ts
@@ -137,7 +137,7 @@ export async function createMemoryResponse(options: {
             status: sidecar?.status ?? null,
             entries: sidecar?.entries,
           })
-          await importDurableSecretProvenance(registry, provenance, record.data)
+          await importDurableSecretProvenance(registry, provenance, record.data, 'memory')
         }
       }
     }
diff --git a/apps/sim/app/api/providers/route.test.ts b/apps/sim/app/api/providers/route.test.ts
index 55641053694..e42cb93a08e 100644
--- a/apps/sim/app/api/providers/route.test.ts
+++ b/apps/sim/app/api/providers/route.test.ts
@@ -208,7 +208,10 @@ describe('POST /api/providers', () => {
     )
 
     expect(res.status).toBe(200)
-    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, { trusted: true })
+    expect(mockImportProvenance).toHaveBeenCalledWith(provenance, {
+      trusted: true,
+      origin: 'providersRoute.requestProvenance',
+    })
   })
 
   it('projects legacy private prompt provenance on the provider-facing copy', async () => {
diff --git a/apps/sim/app/api/providers/route.ts b/apps/sim/app/api/providers/route.ts
index 2fe21daae23..7e6d9845381 100644
--- a/apps/sim/app/api/providers/route.ts
+++ b/apps/sim/app/api/providers/route.ts
@@ -272,7 +272,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       const provenanceReady =
         await providerRuntimeContext.resolvedSecretTraceRegistry.importProvenance(
           provenanceInspection.value,
-          { trusted: true }
+          { trusted: true, origin: 'providersRoute.requestProvenance' }
         )
       if (!provenanceReady || !providerRuntimeContext.resolvedSecretTraceRegistry.isComplete()) {
         return NextResponse.json(
diff --git a/apps/sim/app/api/workflows/[id]/log/route.ts b/apps/sim/app/api/workflows/[id]/log/route.ts
index 8e5123504ed..93984773999 100644
--- a/apps/sim/app/api/workflows/[id]/log/route.ts
+++ b/apps/sim/app/api/workflows/[id]/log/route.ts
@@ -144,7 +144,10 @@ export const POST = withRouteHandler(
         if (trustedProvenance === undefined) {
           resolvedSecretTraceRegistry.markIncomplete()
         } else {
-          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, { trusted: true })
+          await resolvedSecretTraceRegistry.importProvenance(trustedProvenance, {
+            trusted: true,
+            origin: 'workflowLogRoute.trustedProvenance',
+          })
         }
         loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
 
diff --git a/apps/sim/app/layout.tsx b/apps/sim/app/layout.tsx
index 95462d4b290..6f5d5ff5705 100644
--- a/apps/sim/app/layout.tsx
+++ b/apps/sim/app/layout.tsx
@@ -258,7 +258,7 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
           </>
         )}
 
-        {isHosted ? <PublicEnvScript /> : <RuntimePublicEnvScript />}
+        {isHosted ? <PublicEnvScript /> : <RuntimePublicEnvScript disableNextScript />}
       </head>
       <body className={`${season.variable} font-season`} suppressHydrationWarning>
         {/* Google Tag Manager (noscript) — hosted only */}
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/text-editor.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/text-editor.tsx
index 3742e0f5cb5..2c65b3f106a 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/text-editor.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/text-editor.tsx
@@ -264,7 +264,12 @@ const MONACO_LANGUAGE_BY_EXTENSION: Partial<Record<string, string>> = {
   graphql: 'graphql',
   gql: 'graphql',
   json: 'json',
-  jsonl: 'json',
+  /**
+   * Not `json`: JSON Lines holds one value per line, which Monaco's
+   * single-document parser flags as invalid. Validation is global
+   * (`jsonDefaults`), so opting JSONL out is the only per-file lever.
+   */
+  jsonl: 'plaintext',
   yaml: 'yaml',
   yml: 'yaml',
   toml: 'toml',
diff --git a/apps/sim/content/library/what-is-an-agentic-workflow/index.mdx b/apps/sim/content/library/what-is-an-agentic-workflow/index.mdx
new file mode 100644
index 00000000000..f969fe1f70a
--- /dev/null
+++ b/apps/sim/content/library/what-is-an-agentic-workflow/index.mdx
@@ -0,0 +1,98 @@
+---
+slug: what-is-an-agentic-workflow
+title: 'What Is an Agentic Workflow? (And How It''s Different From Automation)'
+description: 'Learn what an agentic workflow is, how it differs from traditional automation, and when to combine AI agent reasoning with deterministic workflow controls.'
+date: 2026-08-10
+updated: 2026-08-10
+authors:
+  - andrew
+readingTime: 7
+tags: [AI Agents, Workflow Automation, Agentic Workflows, Sim]
+ogImage: /library/what-is-an-agentic-workflow/cover.jpg
+canonical: https://www.sim.ai/library/what-is-an-agentic-workflow
+draft: false
+faq:
+  - q: "Is agentic AI the same as automation?"
+    a: "No. Agentic AI chooses actions at runtime, while traditional automation follows human-authored rules. Sim supports both modes in one workflow graph, so you can use reasoning for ambiguous work and fixed logic for predictable steps."
+  - q: "Can Zapier or Make build agentic workflows?"
+    a: "Zapier and Make can include AI or agent steps within their trigger-action workflows. Sim instead treats Agent blocks as first-class parts of the execution graph alongside deterministic blocks. Your choice depends on whether reasoning serves as one isolated step or directs several parts of the workflow."
+  - q: "What is the difference between an AI agent and an agentic workflow?"
+    a: "An AI agent reasons and uses tools, while an agentic workflow coordinates that reasoning with triggers, data, control flow, and other steps. The workflow gives an agent defined inputs, boundaries, and operational context."
+  - q: "Do agentic workflows replace deterministic automation?"
+    a: "No. Agentic workflows still need deterministic automation for validation, routing, approvals, and compliance rules. Sim lets builders combine those fixed steps with model reasoning in one graph, reserving autonomy for decisions that require judgment while keeping sensitive actions predictable."
+---
+
+## TL;DR
+
+- An agentic workflow is a system where an AI model evaluates context and chooses its next action or tool call at runtime.
+- Traditional automation follows triggers, branches, and actions that a human defines in advance. The workflow cannot choose an unplanned next step.
+- Agentic reasoning and deterministic automation serve complementary roles. Production systems often use reasoning for judgment and fixed logic for validation, routing, and approvals.
+- Sim provides one example of this hybrid architecture. Its workflow graph combines Agent blocks with functions, conditions, routers, loops, parallel branches, and human approval.
+
+## What an agentic workflow actually is
+
+An agentic workflow is a system in which a model reasons over available context and chooses its next action or tool call while the workflow runs. Traditional automation follows triggers, branches, and actions that a person defined before execution. This runtime use of reasoning and tools is also central to [what an AI agent is](https://www.sim.ai/library/what-is-an-ai-agent-definition-how-it-works-and-examples).
+
+A support-triage run provides a concrete example. The model reads an email that reports both a billing discrepancy and possible account compromise, checks the customer’s account history, and then chooses between opening a billing ticket and escalating a security case. The email and retrieved account data determine the choice during execution. No human-authored branch covers that exact combination of claims and account history.
+
+Runtime discretion still operates within boundaries. You define the workflow’s goal, available tools, instructions, and permissions in advance. The model decides which permitted action best fits the current context instead of matching the input against a complete set of prewritten conditions.
+
+## What traditional automation is, and where Zapier and Make sit today
+
+Traditional trigger-action automation executes a path that a human defines before the run begins. You choose an event that starts the workflow, then specify which actions follow under each condition. Every trigger and branch is authored in advance. At runtime, the software evaluates those rules, but it cannot choose a new type of action outside them. This distinction resembles the boundary between agents and rule-driven systems explored in [AI agents vs. RPA](https://www.sim.ai/library/ai-agents-vs-rpa).
+
+Zapier and Make grew around this architecture. [Zapier’s conventional workflow builder connects triggers and actions](https://help.zapier.com/hc/en-us/articles/8496183585293-Create-Zaps), while [Make scenarios arrange modules and routes in a visual editor](https://help.make.com/scenario-editor), so builders define the available paths and the conditions that select them. Both platforms now offer agent features through [Zapier Agents](https://zapier.com/agents) and [Make AI Agents](https://www.make.com/en/ai-agents). In a standard automation, however, an AI step usually performs a bounded task inside a predetermined path, such as classifying an email or drafting a reply. Human-authored logic still determines when the model runs and where its output goes.
+
+Trigger-action automation cannot create a path for input its author did not anticipate. A malformed payload may cause the run to fail. An unmatched condition may follow a fallback route or end the run, depending on the authored rules. The software does not inspect the situation and select an unplanned tool. Reasoning remains a capability within a step rather than the mechanism that directs execution.
+
+## Agentic workflows vs. automation, side by side
+
+The main tradeoff is runtime discretion versus human control. Zapier- and Make-style automation follows authored paths, while an agentic workflow lets a model choose among available actions during execution.
+
+| Comparison | Traditional automation | Agentic workflow |
+| --- | --- | --- |
+| Decision-maker | A human defines each trigger, condition, branch, and action before execution. | A model evaluates the current context and selects the next action or tool during execution. |
+| Unexpected input | The workflow follows a fallback path, skips a step, or fails when no authored rule covers the input. | The model can interpret unfamiliar input and choose an available action, although its choice may be wrong. |
+| Flexibility and predictability | Fixed paths produce consistent behavior for known inputs but require edits when requirements change. | Runtime reasoning handles wider input variation but can produce different decisions for similar inputs. |
+| Typical failure mode | Schema drift, missing fields, or unhandled conditions can break the workflow or send execution down the wrong branch. | The model can loop, invent an unsupported tool call, pass invalid arguments, or act on flawed reasoning. |
+| Auditability and debugging | Each action maps directly to an authored node and condition, which makes execution paths easier to reproduce. | Debugging requires inspection of prompts, context, model outputs, and tool calls. Model variability can make exact reproduction harder. |
+
+Neither column represents a universal improvement. Each mode accepts a different set of constraints and failure risks. For a deeper look at tracing model decisions and tool calls, see [AI agent observability](https://www.sim.ai/library/ai-agent-observability).
+
+## Why agentic and deterministic are complementary, not competing
+
+Agentic and deterministic modes solve different kinds of steps, so forcing one mode across an entire workflow usually creates avoidable failure. A fully deterministic workflow cannot handle cases its author did not anticipate. A fully agentic workflow gives a model discretion over steps that may require exact, repeatable behavior.
+
+Deterministic logic belongs wherever the same input should produce the same action. A validator can reject records that lack required fields, while routing rules can send approved records to fixed destinations. Human approval gates can pause refunds or account changes until an authorized person reviews them. These controls give auditors a clear record of which rule produced each action.
+
+Agentic reasoning fits steps that require judgment under ambiguity. A model can interpret an unstructured request and weigh incomplete evidence. The model can then choose between searching a knowledge base, querying a CRM, or asking the user for more information. Because model reasoning can produce an incorrect tool call or enter a loop, the surrounding workflow should enforce tool permissions, retry limits, and output checks.
+
+A support workflow shows how the modes can divide responsibility. Deterministic validation can verify the ticket fields before an agent interprets the customer’s message. The agent can recommend a response and select a relevant tool, while fixed rules route high-value refunds to human approval. Each mode handles the failure it can control most effectively. Practical [support ticket triage patterns](https://www.sim.ai/library/best-ai-agents-support-ticket-triage) apply the same division of responsibility.
+
+Architecture determines how closely those modes can cooperate. Automation-first platforms such as Zapier and Make generally place AI steps inside a trigger-action graph whose surrounding paths remain human-authored, as reflected in the official guides to [adding AI steps in Zapier](https://help.zapier.com/hc/en-us/articles/16276574838925-Use-AI-by-Zapier-in-your-Zap) and [building scenarios in Make](https://help.make.com/scenario-editor). The model can reason within its assigned step, but predefined edges usually control where execution goes afterward. Builders must add branches around the AI output if they want the wider workflow to react differently.
+
+A reasoning-native graph treats the model as a node that can choose tools and return structured decisions to deterministic controls. Fixed blocks can validate the model’s output, restrict available actions, and require approval before execution continues. You can then give the model discretion only where the task needs it, while preserving predictable behavior around sensitive operations.
+
+## How Sim structures agentic and deterministic blocks in one graph
+
+[Sim](https://sim.ai) provides one example of the hybrid pattern. Its visual workflow graph places Agent blocks alongside deterministic blocks, so model reasoning participates directly in execution rather than sitting inside a fixed automation step.
+
+Agent blocks reason over available context and choose tools during a run. Builders can constrain that discretion by selecting the tools an Agent block may call and defining the structured output that later blocks receive.
+
+Deterministic blocks control the parts that need fixed behavior. Functions validate or transform data, while conditions and routers direct execution through human-authored paths. Loops repeat known operations, and parallel branches run independent work concurrently. Human approval can pause the workflow before a consequential action proceeds.
+
+A support workflow shows how these blocks can work together. An Agent block can interpret an unstructured request and propose a category. A function can validate the required fields, and a router can send refund requests for human approval while passing routine account updates to an integration action.
+
+Sim makes the boundary between discretion and control visible in the graph. The Agent block handles ambiguity within its permitted tools, while surrounding blocks enforce validation, routing, and approval rules. You can inspect each block’s inputs and outputs after a run, which helps isolate whether a failure came from model reasoning or deterministic logic.
+
+## Deciding whether a given step should be deterministic or agentic
+
+Evaluate each workflow step separately. A single workflow can use deterministic rules for one decision and agentic reasoning for the next.
+
+- Would the same input always require the same action? Use a deterministic step when you can express the decision as a stable rule.
+- Must an auditor reconstruct why the step ran? Use deterministic logic when you need an explicit decision path, fixed approval rules, or repeatable results.
+- Does the step interpret unstructured input? Use an agent when the answer depends on context, judgment, or meaning that fixed conditions cannot cover reliably.
+- Must the step choose among tools based on the situation? An agent can inspect the request and select an appropriate tool at runtime.
+- Could a wrong decision create a legal or financial consequence? Keep the final action deterministic or require human approval, even if an agent prepares the recommendation.
+
+You can also split one task across both modes. An agent might interpret a customer request and propose a route, while deterministic rules validate required fields and approve the destination. Good workflow design puts the boundary where judgment ends and enforceable rules begin.
diff --git a/apps/sim/executor/handlers/agent/memory.test.ts b/apps/sim/executor/handlers/agent/memory.test.ts
index 1c127b925ce..e59a4c260ba 100644
--- a/apps/sim/executor/handlers/agent/memory.test.ts
+++ b/apps/sim/executor/handlers/agent/memory.test.ts
@@ -1,9 +1,18 @@
 import { loggerMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockDecryptSecret, mockRedactObjectStrings } = vi.hoisted(() => ({
-  mockDecryptSecret: vi.fn(),
-  mockRedactObjectStrings: vi.fn(async (value: unknown) => value),
+const { mockDecryptSecret, mockRedactObjectStrings, mockIsEnforced, mockReportUnrecorded } =
+  vi.hoisted(() => ({
+    mockDecryptSecret: vi.fn(),
+    mockRedactObjectStrings: vi.fn(async (value: unknown) => value),
+    mockIsEnforced: vi.fn(() => false),
+    mockReportUnrecorded: vi.fn(),
+  }))
+
+vi.mock('@/lib/execution/durable-secret-provenance-enforcement', () => ({
+  DURABLE_SECRET_PROVENANCE_SURFACES: ['memory', 'table-row', 'knowledge'],
+  isDurableSecretProvenanceEnforced: mockIsEnforced,
+  reportUnrecordedDurableProvenance: mockReportUnrecorded,
 }))
 
 vi.mock('@/lib/core/security/encryption', () => ({
@@ -35,6 +44,7 @@ describe('Memory', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsEnforced.mockReturnValue(false)
     mockDecryptSecret.mockImplementation(async (encryptedValue: string) => ({
       decrypted: `decrypted:${encryptedValue}`,
     }))
@@ -337,8 +347,8 @@ describe('Memory', () => {
       expect(result.content).toBe('foreign-secret')
     })
 
-    it.each(['123', 'true'])(
-      'projects low-entropy secret %s only in model text and arguments',
+    it.each(['123'])(
+      'projects short secret %s only in model text and arguments',
       async (secret) => {
         const registry = new ResolvedSecretTraceRegistry([
           { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
@@ -503,6 +513,48 @@ describe('Memory', () => {
       expect(messages).toEqual([retainedPublicMessage])
       expect(mockDecryptSecret).not.toHaveBeenCalled()
     })
+
+    /** Trace 2's shape: a stored memory a previous run could not vouch for. */
+    it('reads a memory with unrecorded provenance while the surface stays open', async () => {
+      const registry = new ResolvedSecretTraceRegistry([], {
+        userId: 'user-1',
+        workspaceId: 'workspace-1',
+      })
+      vi.spyOn(memoryService as any, 'fetchMemory').mockResolvedValueOnce({
+        messages: [{ role: 'user', content: 'how do i see my tickets?' }],
+        provenance: { status: 'unknown' },
+      })
+
+      const messages = await memoryService.fetchMemoryMessages(
+        createContext(registry) as never,
+        inputs
+      )
+
+      expect(messages).toEqual([{ role: 'user', content: 'how do i see my tickets?' }])
+      expect(registry.isPermanentlyIncomplete()).toBe(false)
+      expect(mockReportUnrecorded).toHaveBeenCalledWith({
+        surface: 'memory',
+        cause: 'stored-memory-provenance-unknown',
+        workspaceId: 'workspace-1',
+      })
+    })
+
+    it('refuses that same memory once the memory surface is closed', async () => {
+      mockIsEnforced.mockReturnValue(true)
+      const registry = new ResolvedSecretTraceRegistry([], {
+        userId: 'user-1',
+        workspaceId: 'workspace-1',
+      })
+      vi.spyOn(memoryService as any, 'fetchMemory').mockResolvedValueOnce({
+        messages: [{ role: 'user', content: 'how do i see my tickets?' }],
+        provenance: { status: 'unknown' },
+      })
+
+      await expect(
+        memoryService.fetchMemoryMessages(createContext(registry) as never, inputs)
+      ).rejects.toThrow()
+      expect(mockReportUnrecorded).not.toHaveBeenCalled()
+    })
   })
 
   describe('secret-safe diagnostics', () => {
diff --git a/apps/sim/executor/handlers/agent/memory.ts b/apps/sim/executor/handlers/agent/memory.ts
index 13523c742ce..b33d86b0b94 100644
--- a/apps/sim/executor/handlers/agent/memory.ts
+++ b/apps/sim/executor/handlers/agent/memory.ts
@@ -11,6 +11,10 @@ import {
   importDurableSecretProvenance,
   mergeDurableSecretProvenance,
 } from '@/lib/execution/durable-secret-provenance'
+import {
+  isDurableSecretProvenanceEnforced,
+  reportUnrecordedDurableProvenance,
+} from '@/lib/execution/durable-secret-provenance-enforcement'
 import { redactObjectStrings } from '@/lib/logs/execution/pii-redaction'
 import {
   readBoundMemorySecretProvenance,
@@ -75,16 +79,32 @@ export class Memory {
       stored.provenance,
       messages
     )
-    if (
-      selectedProvenance.status === 'unknown' ||
-      (selectedProvenance.entries.length > 0 && !ctx.resolvedSecretTraceRegistry) ||
-      (ctx.resolvedSecretTraceRegistry &&
-        !(await importDurableSecretProvenance(
-          ctx.resolvedSecretTraceRegistry,
-          selectedProvenance,
-          messages
-        )))
-    ) {
+    /**
+     * Unrecorded provenance is checked through the same policy the shared import uses, so stored
+     * memory written by a run that could not vouch does not permanently refuse every later turn.
+     */
+    let refuseStoredProvenance: boolean
+    if (selectedProvenance.status === 'unknown') {
+      refuseStoredProvenance = isDurableSecretProvenanceEnforced('memory')
+      if (!refuseStoredProvenance) {
+        reportUnrecordedDurableProvenance({
+          surface: 'memory',
+          cause: 'stored-memory-provenance-unknown',
+          ...(ctx.workspaceId ? { workspaceId: ctx.workspaceId } : {}),
+        })
+      }
+    } else {
+      refuseStoredProvenance =
+        (selectedProvenance.entries.length > 0 && !ctx.resolvedSecretTraceRegistry) ||
+        (ctx.resolvedSecretTraceRegistry !== undefined &&
+          !(await importDurableSecretProvenance(
+            ctx.resolvedSecretTraceRegistry,
+            selectedProvenance,
+            messages,
+            'memory'
+          )))
+    }
+    if (refuseStoredProvenance) {
       refuseResolvedSecretProjection({
         site: 'memory.storedProvenanceImport',
         message: MEMORY_CONTENT_REFUSAL,
@@ -102,7 +122,14 @@ export class Memory {
           [],
           ctx.resolvedSecretTraceRegistry?.exportProvenance().scope
         )
-        if (!(await importDurableSecretProvenance(modelRegistry, messageProvenance, message))) {
+        if (
+          !(await importDurableSecretProvenance(
+            modelRegistry,
+            messageProvenance,
+            message,
+            'memory'
+          ))
+        ) {
           refuseResolvedSecretProjection({
             site: 'memory.messageProvenanceImport',
             message: MEMORY_CONTENT_REFUSAL,
diff --git a/apps/sim/executor/handlers/mothership/mothership-handler.test.ts b/apps/sim/executor/handlers/mothership/mothership-handler.test.ts
index 6c9a752ec05..aa211829f4f 100644
--- a/apps/sim/executor/handlers/mothership/mothership-handler.test.ts
+++ b/apps/sim/executor/handlers/mothership/mothership-handler.test.ts
@@ -293,7 +293,7 @@ describe('MothershipBlockHandler', () => {
         content: 'raw secret remains functional',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(result).toMatchObject({ content: 'raw secret remains functional' })
@@ -519,7 +519,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
     expect(context.errorResolvedSecretTraceRegistry).not.toBe(context.resolvedSecretTraceRegistry)
@@ -557,7 +557,7 @@ describe('MothershipBlockHandler', () => {
         error: 'secret-backed failure',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(context.errorResolvedSecretTraceRegistry).toBeDefined()
@@ -601,7 +601,7 @@ describe('MothershipBlockHandler', () => {
         content: 'unchanged',
         __resolvedSecretTraceProvenance: undefined,
       }),
-      { trusted: true }
+      { trusted: true, origin: 'mothership.payloadCrossing' }
     )
     expect(registry.markIncomplete).not.toHaveBeenCalled()
     expect(JSON.stringify(result.execution.output)).not.toContain('__resolvedSecretTraceProvenance')
diff --git a/apps/sim/executor/handlers/mothership/mothership-handler.ts b/apps/sim/executor/handlers/mothership/mothership-handler.ts
index b3af3d828d5..1d285cd5df3 100644
--- a/apps/sim/executor/handlers/mothership/mothership-handler.ts
+++ b/apps/sim/executor/handlers/mothership/mothership-handler.ts
@@ -378,7 +378,10 @@ async function consumeMothershipProvenance(
 
   if (!registry) return false
 
-  const imported = await registry.importProvenanceForValue(provenance, payload, { trusted: true })
+  const imported = await registry.importProvenanceForValue(provenance, payload, {
+    trusted: true,
+    origin: 'mothership.payloadCrossing',
+  })
   if (!imported) throw new Error('Mothership response provenance metadata is invalid')
   return true
 }
diff --git a/apps/sim/executor/handlers/workflow/workflow-handler.ts b/apps/sim/executor/handlers/workflow/workflow-handler.ts
index e795c2b99e9..73aa5d4fbf7 100644
--- a/apps/sim/executor/handlers/workflow/workflow-handler.ts
+++ b/apps/sim/executor/handlers/workflow/workflow-handler.ts
@@ -450,6 +450,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await childResolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.childCrossing',
           })
         }
         // Custom-block children authenticate internal tool calls as the source
@@ -711,6 +712,7 @@ export class WorkflowBlockHandler implements BlockHandler {
           await ctx.resolvedSecretTraceRegistry.importProvenance(crossingProvenance, {
             trusted: true,
             anonymous: true,
+            origin: 'workflowHandler.parentCrossing',
           })
         }
         return exposedOutput
diff --git a/apps/sim/executor/utils/resolved-secret-content-projection.test.ts b/apps/sim/executor/utils/resolved-secret-content-projection.test.ts
index 23f1731b0c9..88a38cad883 100644
--- a/apps/sim/executor/utils/resolved-secret-content-projection.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-content-projection.test.ts
@@ -3,7 +3,9 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import {
+  createResolvedSecretMatcher,
   isResolvedSecretModelContentUnchanged,
+  projectResolvedSecretContent,
   projectResolvedSecretDiagnosticError,
   projectResolvedSecretModelContent,
   projectResolvedSecretModelJsonContent,
@@ -175,7 +177,7 @@ describe('projectResolvedSecretModelContent', () => {
     })
   })
 
-  it('projects exact typed primitive secrets without rewriting unrelated primitives', () => {
+  it('projects exact typed numeric secrets, leaving booleans and null identifying nothing', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '123', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'true', encryptedValue: 'boolean-ciphertext' },
@@ -200,17 +202,17 @@ describe('projectResolvedSecretModelContent', () => {
     ).toEqual({
       safe: true,
       value: {
-        strings: ['{{NUMBER}}', '{{BOOLEAN}}', '{{NULL}}'],
+        strings: ['{{NUMBER}}', 'true', 'null'],
         number: '{{NUMBER}}',
-        boolean: '{{BOOLEAN}}',
-        nothing: '{{NULL}}',
+        boolean: true,
+        nothing: null,
         unrelatedNumber: 1234,
         unrelatedBoolean: false,
       },
     })
   })
 
-  it.each(['123', 'true'])('keeps projected JSON argument strings valid (%s)', (secret) => {
+  it.each(['123'])('keeps projected JSON argument strings valid (%s)', (secret) => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
     ])
@@ -231,6 +233,26 @@ describe('projectResolvedSecretModelContent', () => {
     })
   })
 
+  it('leaves a boolean-valued secret in a JSON argument string untouched', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: 'true', encryptedValue: 'ciphertext' },
+    ])
+    registry.recordResolved('TOKEN', 'true')
+
+    const projection = projectResolvedSecretModelJsonStrings(
+      [JSON.stringify({ secret: 'true', converted: true, nested: [true] })],
+      registry
+    )
+
+    expect(projection.safe).toBe(true)
+    if (!projection.safe || !Array.isArray(projection.value)) return
+    expect(JSON.parse(projection.value[0] as string)).toEqual({
+      secret: 'true',
+      converted: true,
+      nested: [true],
+    })
+  })
+
   it('is stable when a secret literal overlaps its own provenance alias', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: 'TOKEN', encryptedValue: 'ciphertext' },
@@ -464,3 +486,46 @@ describe('projectResolvedSecretDiagnosticError', () => {
     })
   })
 })
+
+describe('literals too small to identify anything', () => {
+  const matcher = createResolvedSecretMatcher(
+    [
+      { plaintext: 'false', replacement: '{{BANNER_ENABLED}}' },
+      { plaintext: 'xoxb-real-secret-value', replacement: '{{SLACK_TOKEN}}' },
+    ],
+    { preserveNamedProvenanceLabels: true, mode: 'render' }
+  )!
+
+  const project = (value: unknown) =>
+    projectResolvedSecretContent(value, matcher, 1_000_000, { projectPrimitiveLiterals: true })
+
+  /** A `*_ENABLED` variable holding `false` once rewrote 2,000 boolean cells in one table read. */
+  it('leaves a typed boolean cell alone', () => {
+    expect(project({ had_error: false, ok: true, missing: null })).toEqual({
+      safe: true,
+      value: { had_error: false, ok: true, missing: null },
+    })
+  })
+
+  it('leaves a delimited occurrence inside surrounding text alone', () => {
+    expect(project({ url: 'https://x?fromUser=false&sort=count' })).toEqual({
+      safe: true,
+      value: { url: 'https://x?fromUser=false&sort=count' },
+    })
+  })
+
+  it('still substitutes a real secret sharing the same matcher', () => {
+    expect(project({ token: 'xoxb-real-secret-value', flag: false })).toEqual({
+      safe: true,
+      value: { token: '{{SLACK_TOKEN}}', flag: false },
+    })
+  })
+
+  it('builds no matcher at all when every literal is non-identifying', () => {
+    expect(
+      createResolvedSecretMatcher([{ plaintext: 'true', replacement: '{{FLAG}}' }], {
+        mode: 'render',
+      })
+    ).toBeUndefined()
+  })
+})
diff --git a/apps/sim/executor/utils/resolved-secret-match-policy.test.ts b/apps/sim/executor/utils/resolved-secret-match-policy.test.ts
index 864d920e451..bf79df5754a 100644
--- a/apps/sim/executor/utils/resolved-secret-match-policy.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-match-policy.test.ts
@@ -4,6 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   getResolvedSecretMatchPolicy,
+  isNonIdentifyingSecretLiteral,
   isWordBoundaryMatch,
   MIN_UNANCHORED_MATCH_LENGTH,
 } from '@/executor/utils/resolved-secret-match-policy'
@@ -89,3 +90,19 @@ describe('isWordBoundaryMatch', () => {
     expect(isWordBoundaryMatch('abc', 3, 3)).toBe(true)
   })
 })
+
+describe('isNonIdentifyingSecretLiteral', () => {
+  it.each(['true', 'false', 'null'])(
+    'excludes %s, whose value space is too small to identify',
+    (literal) => {
+      expect(isNonIdentifyingSecretLiteral(literal)).toBe(true)
+    }
+  )
+
+  it.each(['0', '1', 'False', 'TRUE', 'Null', 'nullish', '', 'hunter2', 'sk_live_abc'])(
+    'keeps %s protectable',
+    (literal) => {
+      expect(isNonIdentifyingSecretLiteral(literal)).toBe(false)
+    }
+  )
+})
diff --git a/apps/sim/executor/utils/resolved-secret-match-policy.ts b/apps/sim/executor/utils/resolved-secret-match-policy.ts
index 2bd9ffd0b11..4b572662ed5 100644
--- a/apps/sim/executor/utils/resolved-secret-match-policy.ts
+++ b/apps/sim/executor/utils/resolved-secret-match-policy.ts
@@ -35,6 +35,37 @@ export type ResolvedSecretMatchPolicy = 'anywhere' | 'boundary'
  */
 export const MIN_UNANCHORED_MATCH_LENGTH = 8
 
+/**
+ * Literals that may not match at all, at any offset, because they identify nothing.
+ *
+ * This is cardinality, not entropy — the distinction the floor above turns on. An all-`f` HMAC key
+ * is low-entropy but drawn from an enormous space, so a hit on it is evidence. `false` is drawn
+ * from a space of two: a hit on it is evidence of nothing, and substituting it protects nothing an
+ * attacker could not guess by flipping a coin. Meanwhile it rewrites every boolean any workflow
+ * ever wrote — one deployment turned 2,000 `had_error` cells into `[REDACTED_SECRET]` because a
+ * `*_BANNER_ENABLED` variable happened to hold `false`.
+ *
+ * Exactly the three JSON renderings of a non-string primitive, and nothing else. `0` and `1` are
+ * deliberately absent: a short numeric secret is entirely plausible where a boolean one is not.
+ * Matching is case-sensitive because the set is defined by what `String(value)` produces for a
+ * typed primitive, not by what looks boolean — an environment variable literally holding `False`
+ * keeps its protection.
+ *
+ * The residual is one bit: a variable whose whole value is the string `false` is no longer hidden.
+ */
+const NON_IDENTIFYING_SECRET_LITERALS: ReadonlySet<string> = new Set(['true', 'false', 'null'])
+
+/**
+ * True when a literal carries too little information to be worth protecting anywhere.
+ *
+ * Applied where literals are turned into matchers, so it governs detection and substitution alike:
+ * such a value is never rewritten out of content, and never recorded into durable provenance as
+ * something a later read must redact.
+ */
+export function isNonIdentifyingSecretLiteral(plaintext: string): boolean {
+  return NON_IDENTIFYING_SECRET_LITERALS.has(plaintext)
+}
+
 /**
  * Combining marks count so a substitution cannot split a grapheme cluster. `_` deliberately does
  * NOT: `sk_live_...` and `user_483920_profile` are the dominant way a secret gets joined into an
diff --git a/apps/sim/executor/utils/resolved-secret-matcher.ts b/apps/sim/executor/utils/resolved-secret-matcher.ts
index b20aad11653..60080f3249e 100644
--- a/apps/sim/executor/utils/resolved-secret-matcher.ts
+++ b/apps/sim/executor/utils/resolved-secret-matcher.ts
@@ -1,6 +1,7 @@
 import { MAX_INLINE_MATERIALIZATION_BYTES } from '@/lib/execution/payloads/limits'
 import {
   getResolvedSecretMatchPolicy,
+  isNonIdentifyingSecretLiteral,
   type ResolvedSecretMatchPolicy,
   satisfiesResolvedSecretMatchPolicy,
 } from '@/executor/utils/resolved-secret-match-policy'
@@ -457,7 +458,12 @@ export function createResolvedSecretMatcher(
   const replacementByPlaintext = new Map<string, string>()
 
   for (const match of matches) {
-    if (!match.plaintext) continue
+    /**
+     * Dropped before any construction-time check runs, so no later stage can be talked into
+     * treating one of these as protectable — including the wide-match-set checks below, which
+     * deliberately ignore the narrow policy.
+     */
+    if (!match.plaintext || isNonIdentifyingSecretLiteral(match.plaintext)) continue
     const current = replacementByPlaintext.get(match.plaintext)
     if (current === undefined || compareStrings(match.replacement, current) < 0) {
       replacementByPlaintext.set(match.plaintext, match.replacement)
diff --git a/apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts b/apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts
index 17cdfef8d63..16924a314dd 100644
--- a/apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-projection-refusal.test.ts
@@ -195,6 +195,35 @@ describe('refuseResolvedSecretProjection', () => {
     expect(refusalRecords()).toHaveLength(3)
   })
 
+  it('names the importer that condemned the run, through the fork and merge that hid it', async () => {
+    const parent = new ResolvedSecretTraceRegistry([], scope)
+    const fork = parent.forkForToolCall()
+    await fork.importCrossingProvenance(
+      { version: 1, complete: false, entries: [], scope },
+      { rows: [] },
+      { trusted: true, origin: 'tool.table_query_rows' }
+    )
+    parent.mergeToolCallRegistry(fork)
+    mockLogger.error.mockClear()
+    mockLogger.warn.mockClear()
+
+    expect(() =>
+      refuseResolvedSecretProjection({
+        site: 'router.contextModelInput',
+        message: 'Router model input could not be safely projected',
+        registry: parent,
+        inputPath: 'context,routes',
+      })
+    ).toThrow()
+
+    expect(refusalRecords()[0][1]).toEqual(
+      expect.objectContaining({
+        reason: 'source-provenance-incomplete',
+        origins: ['tool.table_query_rows'],
+      })
+    )
+  })
+
   it('records no secret material', () => {
     const registry = new ResolvedSecretTraceRegistry(
       [{ name: 'API_KEY', plaintext: 'super-secret-value', encryptedValue: 'encrypted' }],
diff --git a/apps/sim/executor/utils/resolved-secret-projection-refusal.ts b/apps/sim/executor/utils/resolved-secret-projection-refusal.ts
index bd8837d7245..24a573225ea 100644
--- a/apps/sim/executor/utils/resolved-secret-projection-refusal.ts
+++ b/apps/sim/executor/utils/resolved-secret-projection-refusal.ts
@@ -64,6 +64,8 @@ function reportRefusal({ site, registry, inputPath }: ResolvedSecretProjectionRe
       ? {
           reason: diagnostics.reasons[0],
           reasons: diagnostics.reasons,
+          /** The importers that cost the run its completeness — who to go and look at. */
+          ...(diagnostics.origins.length > 0 ? { origins: diagnostics.origins } : {}),
           incompleteInputPathCount: diagnostics.incompleteInputPathCount,
           activeEntryCount: diagnostics.activeEntryCount,
           ...(diagnostics.scopeWorkspaceId
diff --git a/apps/sim/executor/utils/resolved-secret-trace-registry.test.ts b/apps/sim/executor/utils/resolved-secret-trace-registry.test.ts
index 0db5b2e881f..e16030c2d88 100644
--- a/apps/sim/executor/utils/resolved-secret-trace-registry.test.ts
+++ b/apps/sim/executor/utils/resolved-secret-trace-registry.test.ts
@@ -1010,11 +1010,11 @@ describe('ResolvedSecretTraceRegistry', () => {
 
   it('conservatively retains every active secret that shares a raw plaintext literal', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'FIRST', plaintext: 'true', encryptedValue: 'first-ciphertext' },
-      { name: 'SECOND', plaintext: 'true', encryptedValue: 'second-ciphertext' },
+      { name: 'FIRST', plaintext: '4815162342', encryptedValue: 'first-ciphertext' },
+      { name: 'SECOND', plaintext: '4815162342', encryptedValue: 'second-ciphertext' },
     ])
-    registry.recordResolved('FIRST', 'true')
-    registry.recordResolved('SECOND', 'true')
+    registry.recordResolved('FIRST', '4815162342')
+    registry.recordResolved('SECOND', '4815162342')
 
     const expected = {
       version: 1 as const,
@@ -1024,11 +1024,11 @@ describe('ResolvedSecretTraceRegistry', () => {
         { name: 'SECOND', encryptedValue: 'second-ciphertext' },
       ],
     }
-    expect(registry.exportCommittedProvenanceForValue('true')).toEqual(expected)
-    expect(registry.exportCommittedProvenanceForValue(true)).toEqual(expected)
+    expect(registry.exportCommittedProvenanceForValue('4815162342')).toEqual(expected)
+    expect(registry.exportCommittedProvenanceForValue(4815162342)).toEqual(expected)
   })
 
-  it('exports active numeric, boolean, and null literals crossing a value boundary', () => {
+  it('exports active numeric literals crossing a value boundary, but not boolean or null', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '1234', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'false', encryptedValue: 'boolean-ciphertext' },
@@ -1048,19 +1048,17 @@ describe('ResolvedSecretTraceRegistry', () => {
     ).toEqual({
       version: 1,
       complete: true,
-      entries: [
-        { encryptedValue: 'boolean-ciphertext' },
-        { encryptedValue: 'null-ciphertext' },
-        { encryptedValue: 'number-ciphertext' },
-      ],
+      entries: [{ encryptedValue: 'number-ciphertext' }],
     })
   })
 
-  it('marks a bounded cross-boundary scan incomplete when an enumerable accessor is opaque', () => {
+  it('keeps every candidate when a bounded cross-boundary scan hits an opaque accessor', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: 'secret', encryptedValue: 'ciphertext' },
+      { name: 'ABSENT', plaintext: 'never-present', encryptedValue: 'absent-ciphertext' },
     ])
     registry.recordResolved('TOKEN', 'secret')
+    registry.recordResolved('ABSENT', 'never-present')
     const value = {}
     Object.defineProperty(value, 'opaque', {
       enumerable: true,
@@ -1069,16 +1067,18 @@ describe('ResolvedSecretTraceRegistry', () => {
 
     expect(registry.exportProvenanceForValue(value, { anonymous: true })).toEqual({
       version: 1,
-      complete: false,
-      entries: [],
+      complete: true,
+      entries: [{ encryptedValue: 'absent-ciphertext' }, { encryptedValue: 'ciphertext' }],
     })
   })
 
-  it('does not claim a complete cross-boundary scan for opaque large-value refs', () => {
+  it('keeps every candidate rather than voiding provenance for an opaque large-value ref', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: 'secret', encryptedValue: 'ciphertext' },
+      { name: 'ABSENT', plaintext: 'never-present', encryptedValue: 'absent-ciphertext' },
     ])
     registry.recordResolved('TOKEN', 'secret')
+    registry.recordResolved('ABSENT', 'never-present')
 
     expect(
       registry.exportProvenanceForValue(
@@ -1091,6 +1091,70 @@ describe('ResolvedSecretTraceRegistry', () => {
         },
         { anonymous: true }
       )
+    ).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ encryptedValue: 'absent-ciphertext' }, { encryptedValue: 'ciphertext' }],
+    })
+  })
+
+  it('lets a model input path survive an upstream output the scan could not read', async () => {
+    const scope = { userId: 'user-1', workspaceId: 'workspace-1' }
+    const catalog = [
+      { name: 'TOKEN', plaintext: 'decrypted:ciphertext', encryptedValue: 'ciphertext' },
+    ]
+    const producer = new ResolvedSecretTraceRegistry(catalog, scope)
+    producer.recordResolved('TOKEN', 'decrypted:ciphertext')
+
+    /** A block output past the traversal bound, exactly as compaction leaves a large table read. */
+    const upstreamOutput = {
+      rows: Array.from({ length: 5_000 }, (_, index) => ({
+        id: `row_${index}`,
+        a: 'a',
+        b: 'b',
+        c: 'c',
+        d: 'd',
+        e: 'e',
+        f: 'f',
+        g: 'g',
+        h: 'h',
+        i: 'i',
+        j: 'j',
+      })),
+    }
+    const upstreamProvenance = producer.exportCommittedProvenanceForValue(upstreamOutput)
+    expect(upstreamProvenance.complete).toBe(true)
+
+    const consumer = new ResolvedSecretTraceRegistry(catalog, scope)
+    await consumer.importProvenanceForValueAtInputPath(
+      upstreamProvenance,
+      upstreamOutput,
+      ['userPrompt'],
+      { trusted: true }
+    )
+
+    const modelFork = consumer.forkForInputPaths([['userPrompt'], ['systemPrompt']])
+    expect(modelFork.projectResolvedInputSelection({ userPrompt: 'classify these rows' })).toEqual({
+      complete: true,
+      value: { userPrompt: 'classify these rows' },
+    })
+  })
+
+  it('still voids provenance for an unscannable value when the registry cannot vouch', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: 'secret', encryptedValue: 'ciphertext' },
+    ])
+    registry.recordResolved('TOKEN', 'secret')
+    registry.markIncomplete('unverified-resolved-entry')
+
+    expect(
+      registry.exportCommittedProvenanceForValue({
+        __simLargeValueRef: true,
+        version: 1,
+        id: 'lv_ABCDEFGHIJKL',
+        kind: 'object',
+        size: 1024,
+      })
     ).toEqual({ version: 1, complete: false, entries: [] })
   })
 
@@ -1110,8 +1174,8 @@ describe('ResolvedSecretTraceRegistry', () => {
 
     expect(provenance).toEqual({
       version: 1,
-      complete: false,
-      entries: [],
+      complete: true,
+      entries: [{ encryptedValue: 'ciphertext' }],
     })
     expect(descriptorSnapshotCalls).toBe(0)
   })
@@ -1498,6 +1562,40 @@ describe('incompleteness diagnostics', () => {
     expect(registry.getIncompletenessDiagnostics()?.reasons[0]).toBe('constructed-incomplete')
   })
 
+  it('attributes an untrustworthy bundle to the caller that imported it', async () => {
+    const registry = new ResolvedSecretTraceRegistry([], scope)
+
+    await registry.importProvenance(
+      { version: 1, complete: false, entries: [], scope },
+      { trusted: true, origin: 'workflowHandler.childCrossing' }
+    )
+
+    expect(registry.getIncompletenessDiagnostics()?.origins).toEqual([
+      'workflowHandler.childCrossing',
+    ])
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Resolved secret registry marked incomplete',
+      expect.objectContaining({
+        reason: 'source-provenance-incomplete',
+        origin: 'workflowHandler.childCrossing',
+      })
+    )
+  })
+
+  it('bounds retained origins, which are caller-supplied rather than a closed union', async () => {
+    const registry = new ResolvedSecretTraceRegistry([], scope)
+
+    for (let index = 0; index < 20; index++) {
+      await registry.importProvenance(
+        { version: 1, complete: false, entries: [], scope },
+        { trusted: true, origin: `caller.${index}` }
+      )
+    }
+
+    expect(registry.getIncompletenessDiagnostics()?.origins).toHaveLength(8)
+    expect(registry.getIncompletenessDiagnostics()?.origins[0]).toBe('caller.0')
+  })
+
   it('records no secret material alongside the reason', () => {
     const registry = new ResolvedSecretTraceRegistry([], scope)
 
@@ -1508,3 +1606,53 @@ describe('incompleteness diagnostics', () => {
     expect(logged).not.toContain('MISSING')
   })
 })
+
+describe('non-identifying literals in durable provenance', () => {
+  /**
+   * The amplifier behind the boolean redaction: once recorded on a row, every later read of that
+   * table reactivated the value and rewrote every boolean in it.
+   */
+  it('never records a value too small to identify anything', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+      { name: 'TOKEN', plaintext: 'xoxb-real-secret-value', encryptedValue: 'token-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+    registry.recordResolved('TOKEN', 'xoxb-real-secret-value')
+
+    expect(registry.exportProvenanceForValue({ had_error: false, note: 'fromUser=false' })).toEqual(
+      { version: 1, complete: true, entries: [] }
+    )
+    expect(registry.exportProvenanceForValue({ token: 'xoxb-real-secret-value' })).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'TOKEN', encryptedValue: 'token-ciphertext' }],
+    })
+  })
+
+  it('still recognizes the internal alias, which names the variable its value cannot', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+
+    expect(registry.exportProvenanceForValue({ code: '__var_BANNER_ENABLED' })).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'BANNER_ENABLED', encryptedValue: 'flag-ciphertext' }],
+    })
+  })
+
+  it('keeps it out of the model matcher so nothing downstream can substitute it', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+
+    const snapshot = registry.getModelEgressSnapshot()
+    expect(snapshot.complete).toBe(true)
+    if (snapshot.complete) {
+      expect(snapshot.matches.map((match) => match.plaintext)).not.toContain('false')
+    }
+  })
+})
diff --git a/apps/sim/executor/utils/resolved-secret-trace-registry.ts b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
index 853573eae6d..c979642edfa 100644
--- a/apps/sim/executor/utils/resolved-secret-trace-registry.ts
+++ b/apps/sim/executor/utils/resolved-secret-trace-registry.ts
@@ -4,6 +4,7 @@ import { decryptSecret } from '@/lib/core/security/encryption'
 import { isLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest-metadata'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
 import { MAX_INLINE_MATERIALIZATION_BYTES } from '@/lib/execution/payloads/limits'
+import { isNonIdentifyingSecretLiteral } from '@/executor/utils/resolved-secret-match-policy'
 import {
   createResolvedSecretMatcher,
   OPAQUE_RESOLVED_SECRET_REPLACEMENT,
@@ -38,6 +39,8 @@ export type ResolvedSecretIncompletenessReason =
   | 'value-provenance-untrusted'
   | 'value-provenance-import-failed'
   | 'value-provenance-filter-incomplete'
+  | 'durable-provenance-unknown'
+  | 'durable-provenance-malformed'
   | 'unspecified'
 
 /**
@@ -64,6 +67,7 @@ const ORIGINATING_FAULT_REASONS = new Set<ResolvedSecretIncompletenessReason>([
   'tool-call-scope-mismatch',
   'value-provenance-untrusted',
   'value-provenance-import-failed',
+  'durable-provenance-malformed',
 ])
 
 /**
@@ -75,6 +79,12 @@ const BY_DESIGN_INCOMPLETENESS_REASONS = new Set<ResolvedSecretIncompletenessRea
   'constructed-incomplete',
 ])
 
+/**
+ * Origins are caller-supplied strings rather than a closed union, so they carry an explicit bound;
+ * one run reaching this many distinct importers already tells the whole story.
+ */
+const MAX_RETAINED_ORIGINS = 8
+
 /**
  * Why a registry can no longer vouch for what it projects, readable at the point a projection is
  * refused rather than only when the guard trips.
@@ -86,6 +96,8 @@ const BY_DESIGN_INCOMPLETENESS_REASONS = new Set<ResolvedSecretIncompletenessRea
 export interface ResolvedSecretIncompletenessDiagnostics {
   /** Distinct reasons in first-occurrence order, so the first is what originally cost completeness. */
   readonly reasons: readonly ResolvedSecretIncompletenessReason[]
+  /** Callers that imported an untrustworthy bundle, in first-occurrence order. */
+  readonly origins: readonly string[]
   readonly incompleteInputPathCount: number
   /** Present so a refusal record joins to the mark-time record that shares these counts. */
   readonly activeEntryCount: number
@@ -161,17 +173,35 @@ interface ResolvedInputPathState {
 interface PreparedProvenanceFilter {
   candidatesByScanLiteral: ReadonlyMap<string, readonly ActiveSecretEntry[]>
   candidatesByAlias: ReadonlyMap<string, readonly ActiveSecretEntry[]>
-  candidateEntryKeys: ReadonlySet<string>
+  candidateEntries: ReadonlyMap<string, ActiveSecretEntry>
   matcher?: ResolvedSecretMatcher
 }
 
+/**
+ * Carries the candidate entries on both arms, because they are the answer whenever narrowing is
+ * unavailable — including when the matcher itself could not be built.
+ */
 type PreparedProvenanceFilterResult =
   | { complete: true; filter: PreparedProvenanceFilter }
-  | { complete: false }
+  | { complete: false; candidateEntries: ReadonlyMap<string, ActiveSecretEntry> }
+
+/** Extra attribution for a latch: which registry it propagated from, and which importer caused it. */
+interface MarkIncompleteContext {
+  source?: ResolvedSecretTraceRegistry
+  origin?: string
+}
 
 export interface ImportResolvedSecretTraceProvenanceOptions {
   trusted: boolean
   anonymous?: boolean
+  /**
+   * Stable dotted identifier for the caller, e.g. `workflowHandler.childCrossing`.
+   *
+   * A bundle that arrives already incomplete condemns the whole run, and the reason alone cannot
+   * say which of the many importers accepted it. Recording the caller is what turns
+   * `source-provenance-incomplete` from a symptom into an address.
+   */
+  origin?: string
 }
 
 export interface ExportResolvedSecretTraceProvenanceForValueOptions {
@@ -619,6 +649,8 @@ export class ResolvedSecretTraceRegistry {
   private readonly incompleteInputPaths = new Map<string, string[]>()
   /** Insertion-ordered; see {@link ResolvedSecretIncompletenessDiagnostics}. */
   private readonly incompletenessReasons = new Set<ResolvedSecretIncompletenessReason>()
+  /** Import callers that cost this registry its completeness; bounded by {@link MAX_RETAINED_ORIGINS}. */
+  private readonly incompletenessOrigins = new Set<string>()
   private activeProvenanceEntryBytes = 0
   private complete = true
   private pendingActivations = 0
@@ -673,7 +705,7 @@ export class ResolvedSecretTraceRegistry {
     }
     this.copyResolvedInputPathsTo(fork)
     this.copyIncompleteInputPathsTo(fork)
-    if (!this.complete) fork.markIncomplete('inherited-incomplete-source', this)
+    if (!this.complete) fork.markIncomplete('inherited-incomplete-source', { source: this })
     return fork
   }
 
@@ -684,12 +716,12 @@ export class ResolvedSecretTraceRegistry {
   ): ResolvedSecretTraceRegistry {
     const fork = new ResolvedSecretTraceRegistry(this.catalog.values(), this.scope)
     if (!this.complete) {
-      fork.markIncomplete('inherited-incomplete-source', this)
+      fork.markIncomplete('inherited-incomplete-source', { source: this })
       return fork
     }
 
     if (this.hasIncompleteInputPathOverlapping(paths)) {
-      fork.markIncomplete('inherited-incomplete-input-path', this)
+      fork.markIncomplete('inherited-incomplete-input-path', { source: this })
       return fork
     }
 
@@ -713,7 +745,8 @@ export class ResolvedSecretTraceRegistry {
         fork.addActiveEntry({ ...entry }, { propagated: true })
       }
     }
-    if (this.isPermanentlyIncomplete()) fork.markIncomplete('inherited-incomplete-source', this)
+    if (this.isPermanentlyIncomplete())
+      fork.markIncomplete('inherited-incomplete-source', { source: this })
     return fork
   }
 
@@ -725,7 +758,7 @@ export class ResolvedSecretTraceRegistry {
     }
 
     if (!child.isComplete()) {
-      this.markIncomplete('inherited-incomplete-source', child)
+      this.markIncomplete('inherited-incomplete-source', { source: child })
       return
     }
 
@@ -1092,12 +1125,12 @@ export class ResolvedSecretTraceRegistry {
     options: ImportResolvedSecretTraceProvenanceOptions
   ): Promise<boolean> {
     if (!options.trusted || !isResolvedSecretTraceProvenanceV1(provenance)) {
-      this.markIncomplete('untrusted-provenance')
+      this.markIncomplete('untrusted-provenance', { origin: options.origin })
       return false
     }
 
     if (!provenance.complete) {
-      this.markIncomplete('source-provenance-incomplete')
+      this.markIncomplete('source-provenance-incomplete', { origin: options.origin })
     }
 
     const sameScope = scopesMatch(provenance.scope, this.scope)
@@ -1120,7 +1153,7 @@ export class ResolvedSecretTraceRegistry {
         importedAll = false
         decryptFailures += 1
         firstDecryptError ??= getErrorMessage(error, 'Unknown error')
-        this.markIncomplete('entry-decrypt-failed')
+        this.markIncomplete('entry-decrypt-failed', { origin: options.origin })
       }
     }
 
@@ -1148,7 +1181,7 @@ export class ResolvedSecretTraceRegistry {
   async importProvenanceForValue(
     provenance: unknown,
     value: unknown,
-    options: { trusted: boolean }
+    options: { trusted: boolean; origin?: string }
   ): Promise<boolean> {
     const result = await this.importProvenanceForValueInternal(provenance, value, options)
     return result.success
@@ -1159,7 +1192,7 @@ export class ResolvedSecretTraceRegistry {
     provenance: unknown,
     value: unknown,
     inputPath: ResolvedSecretInputPath | undefined,
-    options: { trusted: boolean }
+    options: { trusted: boolean; origin?: string }
   ): Promise<ImportResolvedSecretTraceProvenanceForValueResult> {
     return this.importProvenanceForValueInternal(provenance, value, {
       ...options,
@@ -1170,28 +1203,39 @@ export class ResolvedSecretTraceRegistry {
   private async importProvenanceForValueInternal(
     provenance: unknown,
     value: unknown,
-    options: { trusted: boolean; inputPath?: ResolvedSecretInputPath }
+    options: { trusted: boolean; inputPath?: ResolvedSecretInputPath; origin?: string }
   ): Promise<ImportResolvedSecretTraceProvenanceForValueResult> {
     if (!options.trusted || !isResolvedSecretTraceProvenanceV1(provenance)) {
-      this.markInputPathIncomplete(options.inputPath, 'value-provenance-untrusted')
+      this.markInputPathIncomplete(options.inputPath, 'value-provenance-untrusted', options.origin)
       return { success: false, matched: false }
     }
 
     const sourceRegistry = new ResolvedSecretTraceRegistry([], provenance.scope, { staged: true })
-    const sourceImported = await sourceRegistry.importProvenance(provenance, { trusted: true })
+    const sourceImported = await sourceRegistry.importProvenance(provenance, {
+      trusted: true,
+      origin: options.origin,
+    })
     const filteredProvenance = sourceRegistry.exportProvenanceForValue(value)
     if (!sourceImported) {
-      this.markInputPathIncomplete(options.inputPath, 'value-provenance-import-failed')
+      this.markInputPathIncomplete(
+        options.inputPath,
+        'value-provenance-import-failed',
+        options.origin
+      )
       return { success: false, matched: false }
     }
     if (!filteredProvenance.complete) {
       this.markInputPathIncomplete(
         options.inputPath,
-        provenance.complete ? 'value-provenance-filter-incomplete' : 'source-provenance-incomplete'
+        provenance.complete ? 'value-provenance-filter-incomplete' : 'source-provenance-incomplete',
+        options.origin
       )
       return { success: true, matched: false }
     }
-    const filteredImported = await this.importProvenance(filteredProvenance, { trusted: true })
+    const filteredImported = await this.importProvenance(filteredProvenance, {
+      trusted: true,
+      origin: options.origin,
+    })
     if (options.inputPath && options.inputPath.length > 0 && filteredProvenance.complete) {
       const sameScope = scopesMatch(filteredProvenance.scope, this.scope)
       this.bindResolvedInputPathEntries(
@@ -1220,7 +1264,7 @@ export class ResolvedSecretTraceRegistry {
   async importCrossingProvenance(
     provenance: unknown,
     crossingValue: unknown,
-    options: { trusted: boolean }
+    options: { trusted: boolean; origin?: string }
   ): Promise<boolean> {
     return this.importProvenanceForValue(provenance, crossingValue, options)
   }
@@ -1296,7 +1340,12 @@ export class ResolvedSecretTraceRegistry {
   private buildMatches(entries: Iterable<ActiveSecretEntry>): readonly ResolvedSecretTraceMatch[] {
     const candidatesByPlaintext = new Map<string, ActiveSecretEntry[]>()
     for (const entry of entries) {
-      if (entry.plaintext.length === 0) continue
+      /**
+       * Dropped here too, not only inside the matcher, so a literal that will never be substituted
+       * also never counts toward the matcher capacity bound or appears to a snapshot reader as
+       * something this registry protects.
+       */
+      if (entry.plaintext.length === 0 || isNonIdentifyingSecretLiteral(entry.plaintext)) continue
       const candidates = candidatesByPlaintext.get(entry.plaintext) ?? []
       candidates.push(entry)
       candidatesByPlaintext.set(entry.plaintext, candidates)
@@ -1338,6 +1387,7 @@ export class ResolvedSecretTraceRegistry {
     if (!this.isPermanentlyIncomplete()) return undefined
     return {
       reasons: [...this.incompletenessReasons],
+      origins: [...this.incompletenessOrigins],
       incompleteInputPathCount: this.incompleteInputPaths.size,
       activeEntryCount: this.activeEntries.size,
       ...(this.scope?.workspaceId ? { scopeWorkspaceId: this.scope.workspaceId } : {}),
@@ -1349,12 +1399,19 @@ export class ResolvedSecretTraceRegistry {
     this.incompletenessReasons.add(reason)
   }
 
+  /** Retains the importing caller, keeping the earliest once the bound is reached. */
+  private recordIncompletenessOrigin(origin: string): void {
+    if (this.incompletenessOrigins.size >= MAX_RETAINED_ORIGINS) return
+    this.incompletenessOrigins.add(origin)
+  }
+
   /**
    * Carries a source registry's reasons into a fork or merge target, so a refusal downstream still
    * names the guard that originally tripped rather than only the propagation that reached it.
    */
   private inheritIncompletenessReasonsFrom(source: ResolvedSecretTraceRegistry): void {
     for (const reason of source.incompletenessReasons) this.recordIncompletenessReason(reason)
+    for (const origin of source.incompletenessOrigins) this.recordIncompletenessOrigin(origin)
   }
 
   isPermanentlyIncomplete(): boolean {
@@ -1363,16 +1420,18 @@ export class ResolvedSecretTraceRegistry {
 
   markIncomplete(
     reason: ResolvedSecretIncompletenessReason = 'unspecified',
-    source?: ResolvedSecretTraceRegistry
+    context: MarkIncompleteContext = {}
   ): void {
-    if (source) this.inheritIncompletenessReasonsFrom(source)
+    if (context.source) this.inheritIncompletenessReasonsFrom(context.source)
     this.recordIncompletenessReason(reason)
+    if (context.origin) this.recordIncompletenessOrigin(context.origin)
     if (!this.complete) return
     this.complete = false
     this.modelEgressRevision += 1
     if (this.staged || BY_DESIGN_INCOMPLETENESS_REASONS.has(reason)) return
     const details = {
       reason,
+      ...(context.origin ? { origin: context.origin } : {}),
       scopeWorkspaceId: this.scope?.workspaceId,
       activeEntryCount: this.activeEntries.size,
       incompleteInputPathCount: this.incompleteInputPaths.size,
@@ -1495,16 +1554,21 @@ export class ResolvedSecretTraceRegistry {
   }
 
   private prepareProvenanceFilter(
-    candidateEntries: Iterable<ActiveSecretEntry>
+    sourceEntries: Iterable<ActiveSecretEntry>
   ): PreparedProvenanceFilterResult {
     const candidatesByPlaintext = new Map<string, ActiveSecretEntry[]>()
-    const sortedCandidateEntries = [...candidateEntries].sort(
+    const sortedCandidateEntries = [...sourceEntries].sort(
       (left, right) =>
         compareStrings(left.name, right.name) ||
         compareStrings(left.encryptedValue, right.encryptedValue)
     )
     for (const entry of sortedCandidateEntries) {
-      if (entry.plaintext.length === 0) continue
+      /**
+       * Excluded from scan literals as well as from the matcher, so such a value is never recorded
+       * into durable provenance as something a later read must redact. A named entry still joins
+       * the alias loop below — `__var_NAME` identifies the variable even when its value does not.
+       */
+      if (entry.plaintext.length === 0 || isNonIdentifyingSecretLiteral(entry.plaintext)) continue
       const candidates = candidatesByPlaintext.get(entry.plaintext) ?? []
       const entryKey = activeEntryKey(entry)
       if (!candidates.some((candidate) => activeEntryKey(candidate) === entryKey)) {
@@ -1514,7 +1578,7 @@ export class ResolvedSecretTraceRegistry {
     }
 
     const candidatesByScanLiteral = new Map<string, ActiveSecretEntry[]>()
-    const candidateEntryKeys = new Set<string>()
+    const candidateEntries = new Map<string, ActiveSecretEntry>()
     const addScanLiteral = (literal: string, entry: ActiveSecretEntry): void => {
       if (literal.length === 0) return
       const candidates = candidatesByScanLiteral.get(literal) ?? []
@@ -1523,7 +1587,7 @@ export class ResolvedSecretTraceRegistry {
         candidates.push(entry)
         candidatesByScanLiteral.set(literal, candidates)
       }
-      candidateEntryKeys.add(entryKey)
+      candidateEntries.set(entryKey, entry)
     }
     for (const candidates of candidatesByPlaintext.values()) {
       for (const entry of candidates) {
@@ -1542,7 +1606,7 @@ export class ResolvedSecretTraceRegistry {
         candidates.push(entry)
         candidatesByAlias.set(alias, candidates)
       }
-      candidateEntryKeys.add(entryKey)
+      candidateEntries.set(entryKey, entry)
     }
 
     let matcher: ResolvedSecretMatcher | undefined
@@ -1555,7 +1619,7 @@ export class ResolvedSecretTraceRegistry {
         error: getErrorMessage(error, 'Unknown error'),
         candidateCount: candidatesByScanLiteral.size,
       })
-      return { complete: false }
+      return { complete: false, candidateEntries }
     }
 
     return {
@@ -1563,12 +1627,49 @@ export class ResolvedSecretTraceRegistry {
       filter: {
         candidatesByScanLiteral,
         candidatesByAlias,
-        candidateEntryKeys,
+        candidateEntries,
         ...(matcher ? { matcher } : {}),
       },
     }
   }
 
+  /** Builds the envelope for one selected entry set; only this registry's own state can void it. */
+  private provenanceForSelectedEntries(
+    entries: ReadonlyMap<string, ActiveSecretEntry>,
+    options: ExportResolvedSecretTraceProvenanceForValueOptions
+  ): ResolvedSecretTraceProvenanceV1 {
+    const complete = !this.isPermanentlyIncomplete()
+    return {
+      version: 1,
+      complete,
+      entries: complete
+        ? this.buildProvenanceEntries([...entries.values()], options.anonymous)
+        : [],
+      ...(this.scope ? { scope: cloneProvenanceScope(this.scope) } : {}),
+    }
+  }
+
+  /**
+   * Answers a value the bounded scan could not read in full by keeping every candidate entry.
+   *
+   * Narrowing exists to stop content that provably carries no secret from being over-redacted; it
+   * is not what makes an envelope trustworthy. The candidates are already the trusted answer to
+   * "which secrets could this value carry", so an unreadable value — an offloaded large-value ref
+   * the scan cannot see through, a payload past the traversal bound, a hostile accessor — degrades
+   * to no narrowing rather than to unknown provenance.
+   *
+   * Reporting unknown here is what let a size threshold behave like a permanent fault: the flag
+   * travels onto the producing block's state, and every model boundary that later consumes that
+   * output refuses, with nothing telling the author the cause was payload volume rather than a
+   * secret. Over-approximating costs extra redaction; it can never under-redact.
+   */
+  private unnarrowedProvenance(
+    candidateEntries: ReadonlyMap<string, ActiveSecretEntry>,
+    options: ExportResolvedSecretTraceProvenanceForValueOptions
+  ): ResolvedSecretTraceProvenanceV1 {
+    return this.provenanceForSelectedEntries(candidateEntries, options)
+  }
+
   private exportProvenanceForValueWithPreparedFilter(
     value: unknown,
     prepared: PreparedProvenanceFilterResult,
@@ -1583,37 +1684,22 @@ export class ResolvedSecretTraceRegistry {
     options: ExportResolvedSecretTraceProvenanceForValueOptions
   ): ResolvedSecretTraceProvenanceV1 {
     if (!prepared.complete) {
-      return {
-        version: 1,
-        complete: false,
-        entries: [],
-        ...(this.scope ? { scope: cloneProvenanceScope(this.scope) } : {}),
-      }
+      return this.unnarrowedProvenance(prepared.candidateEntries, options)
     }
 
-    const { candidatesByScanLiteral, candidatesByAlias, candidateEntryKeys, matcher } =
+    const { candidatesByScanLiteral, candidatesByAlias, candidateEntries, matcher } =
       prepared.filter
     const matchedEntries = new Map<string, ActiveSecretEntry>()
     const pendingValues: unknown[] = []
     try {
       for (const value of values) {
         if (pendingValues.length >= MAX_PROVENANCE_FILTER_NODES) {
-          return {
-            version: 1,
-            complete: false,
-            entries: [],
-            ...(this.scope ? { scope: cloneProvenanceScope(this.scope) } : {}),
-          }
+          return this.unnarrowedProvenance(candidateEntries, options)
         }
         pendingValues.push(value)
       }
     } catch {
-      return {
-        version: 1,
-        complete: false,
-        entries: [],
-        ...(this.scope ? { scope: cloneProvenanceScope(this.scope) } : {}),
-      }
+      return this.unnarrowedProvenance(candidateEntries, options)
     }
     const visited = new WeakSet<object>()
     let scannedNodes = 0
@@ -1661,7 +1747,7 @@ export class ResolvedSecretTraceRegistry {
       if (scannedNodes + pendingValues.length >= MAX_PROVENANCE_FILTER_NODES) return false
       scannedNodes++
       if (!scanString(key)) return false
-      if (matchedEntries.size >= candidateEntryKeys.size) return true
+      if (matchedEntries.size >= candidateEntries.size) return true
 
       if ('value' in descriptor) {
         if (scannedNodes + pendingValues.length >= MAX_PROVENANCE_FILTER_NODES) return false
@@ -1672,7 +1758,7 @@ export class ResolvedSecretTraceRegistry {
       return true
     }
 
-    while (pendingValues.length > 0 && matchedEntries.size < candidateEntryKeys.size) {
+    while (pendingValues.length > 0 && matchedEntries.size < candidateEntries.size) {
       const current = pendingValues.pop()
       scannedNodes++
       if (scannedNodes > MAX_PROVENANCE_FILTER_NODES) {
@@ -1708,9 +1794,9 @@ export class ResolvedSecretTraceRegistry {
             scanComplete = false
             break
           }
-          if (matchedEntries.size >= candidateEntryKeys.size) break
+          if (matchedEntries.size >= candidateEntries.size) break
         }
-        if (!scanComplete || matchedEntries.size >= candidateEntryKeys.size) break
+        if (!scanComplete || matchedEntries.size >= candidateEntries.size) break
 
         for (const key in current as Record<string, unknown>) {
           enumeratedProperties++
@@ -1725,7 +1811,7 @@ export class ResolvedSecretTraceRegistry {
             scanComplete = false
             break
           }
-          if (matchedEntries.size >= candidateEntryKeys.size) break
+          if (matchedEntries.size >= candidateEntries.size) break
         }
         if (!scanComplete) break
       } catch {
@@ -1734,16 +1820,9 @@ export class ResolvedSecretTraceRegistry {
       }
     }
 
-    const complete = !this.isPermanentlyIncomplete() && scanComplete
-    const entries = complete
-      ? this.buildProvenanceEntries([...matchedEntries.values()], options.anonymous)
-      : []
-    return {
-      version: 1,
-      complete,
-      entries,
-      ...(this.scope ? { scope: cloneProvenanceScope(this.scope) } : {}),
-    }
+    return scanComplete
+      ? this.provenanceForSelectedEntries(matchedEntries, options)
+      : this.unnarrowedProvenance(candidateEntries, options)
   }
 
   private collectInputPathEntryKeys(paths: readonly ResolvedSecretInputPath[]): Set<string> {
@@ -1791,13 +1870,15 @@ export class ResolvedSecretTraceRegistry {
 
   private markInputPathIncomplete(
     path: ResolvedSecretInputPath | undefined,
-    reason: ResolvedSecretIncompletenessReason = 'unspecified'
+    reason: ResolvedSecretIncompletenessReason = 'unspecified',
+    origin?: string
   ): void {
     if (!path || path.length === 0) {
-      this.markIncomplete(reason)
+      this.markIncomplete(reason, { origin })
       return
     }
     this.recordIncompletenessReason(reason)
+    if (origin) this.recordIncompletenessOrigin(origin)
     const key = inputPathKey(path)
     if (this.incompleteInputPaths.has(key)) return
     this.incompleteInputPaths.set(key, [...path])
@@ -1805,6 +1886,7 @@ export class ResolvedSecretTraceRegistry {
     if (this.staged || BY_DESIGN_INCOMPLETENESS_REASONS.has(reason)) return
     const details = {
       reason,
+      ...(origin ? { origin } : {}),
       inputPath: path.join('.'),
       scopeWorkspaceId: this.scope?.workspaceId,
       activeEntryCount: this.activeEntries.size,
diff --git a/apps/sim/executor/variables/resolvers/block.ts b/apps/sim/executor/variables/resolvers/block.ts
index b057a97501c..83f20eecd27 100644
--- a/apps/sim/executor/variables/resolvers/block.ts
+++ b/apps/sim/executor/variables/resolvers/block.ts
@@ -337,7 +337,7 @@ export class BlockResolver implements Resolver {
         state.resolvedSecretTraceProvenance,
         value,
         context.inputPath,
-        { trusted: true }
+        { trusted: true, origin: 'blockResolver.outputCrossing' }
       )
     if (imported.matched) context.onResolvedSecretReference?.()
     return value
diff --git a/apps/sim/executor/variables/resolvers/loop.ts b/apps/sim/executor/variables/resolvers/loop.ts
index 3c29af6a45c..523af3cfc9f 100644
--- a/apps/sim/executor/variables/resolvers/loop.ts
+++ b/apps/sim/executor/variables/resolvers/loop.ts
@@ -283,7 +283,7 @@ export class LoopResolver implements Resolver {
       provenance,
       resolvedValue,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'loopResolver.itemCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return resolvedValue
diff --git a/apps/sim/executor/variables/resolvers/parallel.ts b/apps/sim/executor/variables/resolvers/parallel.ts
index fdec9d5cdd0..12c95cf9ca8 100644
--- a/apps/sim/executor/variables/resolvers/parallel.ts
+++ b/apps/sim/executor/variables/resolvers/parallel.ts
@@ -390,7 +390,7 @@ export class ParallelResolver implements Resolver {
       provenance,
       resolvedValue,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'parallelResolver.itemCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return resolvedValue
diff --git a/apps/sim/executor/variables/resolvers/workflow.ts b/apps/sim/executor/variables/resolvers/workflow.ts
index 7bc0a6299ad..8d0c778016b 100644
--- a/apps/sim/executor/variables/resolvers/workflow.ts
+++ b/apps/sim/executor/variables/resolvers/workflow.ts
@@ -133,7 +133,7 @@ export class WorkflowResolver implements Resolver {
       provenance,
       value,
       context.inputPath,
-      { trusted: true }
+      { trusted: true, origin: 'workflowResolver.inputCrossing' }
     )
     if (imported.matched) context.onResolvedSecretReference?.()
     return value
diff --git a/apps/sim/lib/content/registry-factory.test.ts b/apps/sim/lib/content/registry-factory.test.ts
new file mode 100644
index 00000000000..4a160728929
--- /dev/null
+++ b/apps/sim/lib/content/registry-factory.test.ts
@@ -0,0 +1,83 @@
+/**
+ * @vitest-environment node
+ */
+import fs from 'fs/promises'
+import os from 'os'
+import path from 'path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+
+/**
+ * `sharp` resolves a platform-specific `@img/sharp-*` native binary that the
+ * standalone file tracer cannot follow, so a deployment can ship without it. It
+ * must therefore be loaded lazily and its failure contained: an unreadable OG
+ * dimension is optional metadata, not a reason to take down `/blog`, `/library`,
+ * and every tag, author, slug, and RSS route that reads the registry.
+ *
+ * This mock makes `import('sharp')` fail the way a missing native binary does.
+ */
+vi.mock('sharp', () => {
+  throw new Error('Could not load the sharp module using the linux-x64 runtime')
+})
+
+vi.mock('next-mdx-remote/rsc', () => ({
+  compileMDX: vi.fn(async () => ({ content: null })),
+}))
+
+vi.mock('@/lib/content/mdx', () => ({ mdxComponents: {} }))
+
+import { createContentRegistry } from '@/lib/content/registry-factory'
+
+let root: string
+let contentDir: string
+let authorsDir: string
+
+const POST = `---
+slug: sharp-is-unavailable
+title: Sharp Is Unavailable
+description: The registry still serves posts when the native binary is missing.
+date: 2026-08-10
+authors: [waleed]
+ogImage: /blog/missing-og.png
+canonical: https://sim.ai/blog/sharp-is-unavailable
+---
+
+Body copy.
+`
+
+const AUTHOR = JSON.stringify({ id: 'waleed', name: 'Waleed Latif' })
+
+beforeAll(async () => {
+  root = await fs.mkdtemp(path.join(os.tmpdir(), 'content-registry-'))
+  contentDir = path.join(root, 'content', 'blog')
+  authorsDir = path.join(root, 'content', 'authors')
+  await fs.mkdir(path.join(contentDir, 'sharp-is-unavailable'), { recursive: true })
+  await fs.mkdir(authorsDir, { recursive: true })
+  await fs.writeFile(path.join(contentDir, 'sharp-is-unavailable', 'index.mdx'), POST)
+  await fs.writeFile(path.join(authorsDir, 'waleed.json'), AUTHOR)
+})
+
+afterAll(async () => {
+  await fs.rm(root, { recursive: true, force: true })
+})
+
+describe('createContentRegistry without a loadable sharp', () => {
+  it('still lists posts, omitting only the OG dimensions', async () => {
+    const registry = createContentRegistry({ contentDir, authorsDir })
+
+    const posts = await registry.getAllPostMeta()
+
+    expect(posts).toHaveLength(1)
+    expect(posts[0].slug).toBe('sharp-is-unavailable')
+    expect(posts[0].ogImage).toBe('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/blog/missing-og.png')
+    expect(posts[0].ogImageWidth).toBeUndefined()
+    expect(posts[0].ogImageHeight).toBeUndefined()
+  })
+
+  it('still resolves a single post by slug', async () => {
+    const registry = createContentRegistry({ contentDir, authorsDir })
+
+    const post = await registry.getPostBySlug('sharp-is-unavailable')
+
+    expect(post?.title).toBe('Sharp Is Unavailable')
+  })
+})
diff --git a/apps/sim/lib/content/registry-factory.ts b/apps/sim/lib/content/registry-factory.ts
index 8df6fceba6f..a526cfd8b6c 100644
--- a/apps/sim/lib/content/registry-factory.ts
+++ b/apps/sim/lib/content/registry-factory.ts
@@ -2,12 +2,12 @@ import fs from 'fs/promises'
 import path from 'path'
 import { cache } from 'react'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import matter from 'gray-matter'
 import { compileMDX } from 'next-mdx-remote/rsc'
 import rehypeAutolinkHeadings from 'rehype-autolink-headings'
 import rehypeSlug from 'rehype-slug'
 import remarkGfm from 'remark-gfm'
-import sharp from 'sharp'
 import { mdxComponents } from '@/lib/content/mdx'
 import type { Author, ContentMeta, ContentPost, TagWithCount } from '@/lib/content/schema'
 import { AuthorSchema, ContentFrontmatterSchema } from '@/lib/content/schema'
@@ -102,6 +102,13 @@ export function createContentRegistry(config: ContentRegistryConfig): ContentReg
    * Uses `sharp`, which only parses headers for `metadata()`. It replaced the
    * `image-size` package, archived upstream with unpatched DoS advisories in
    * its ICNS/JXL/HEIF parsers (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq).
+   *
+   * `sharp` is loaded lazily, never as a top-level import. It resolves a
+   * platform-specific `@img/sharp-*` native binary that the standalone file
+   * tracer cannot follow, so a deployment that ships without it makes
+   * `import 'sharp'` throw at module scope — which would take down every route
+   * that touches this registry (`/blog`, `/library`, their tag, author, slug,
+   * and RSS routes) rather than degrading one optional OG dimension.
    */
   async function readOgImageDimensions(
     ogImage: string
@@ -109,6 +116,7 @@ export function createContentRegistry(config: ContentRegistryConfig): ContentReg
     if (ogImage.startsWith('http')) return null
     try {
       const buffer = await fs.readFile(path.join(process.cwd(), 'public', ogImage))
+      const sharp = (await import('sharp')).default
       const { width, height } = await sharp(buffer).metadata()
       if (!width || !height) {
         logger.warn('OG image has no readable dimensions; falling back to the OG default', {
@@ -117,7 +125,11 @@ export function createContentRegistry(config: ContentRegistryConfig): ContentReg
         return null
       }
       return { width, height }
-    } catch {
+    } catch (error) {
+      logger.warn('Failed to read OG image dimensions; falling back to the OG default', {
+        ogImage,
+        error: getErrorMessage(error),
+      })
       return null
     }
   }
diff --git a/apps/sim/lib/copilot/request/tools/client.ts b/apps/sim/lib/copilot/request/tools/client.ts
index a7aac65cd12..c2651bfa114 100644
--- a/apps/sim/lib/copilot/request/tools/client.ts
+++ b/apps/sim/lib/copilot/request/tools/client.ts
@@ -103,17 +103,20 @@ export async function waitForClientToolCompletion({
         toolRegistry.markIncomplete()
       } else {
         const imported = await toolRegistry.importProvenance(sealedContext.provenance, {
+          origin: 'copilotToolClient.sealedContext',
           trusted: true,
         })
         if (!imported || !sealedContext.provenance.complete) {
-          toolRegistry.markIncomplete()
+          toolRegistry.markIncomplete('source-provenance-incomplete', {
+            origin: 'copilotToolClient.sealedContext',
+          })
         } else {
           content = sealedContent
         }
       }
     }
   } catch {
-    toolRegistry?.markIncomplete()
+    toolRegistry?.markIncomplete('unspecified', { origin: 'copilotToolClient.sealedContext' })
   } finally {
     finishPendingActivation?.()
   }
diff --git a/apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts b/apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts
index e138881aa12..2cb2066c699 100644
--- a/apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts
+++ b/apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts
@@ -227,7 +227,7 @@ describe('projectToolResultForCopilot', () => {
     ).toEqual({ success: true, output: { result: encoded } })
   })
 
-  it('projects exact typed primitive secrets and the same values as strings', () => {
+  it('projects exact typed numeric secrets, leaving booleans and null identifying nothing', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '123', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'true', encryptedValue: 'boolean-ciphertext' },
@@ -256,11 +256,11 @@ describe('projectToolResultForCopilot', () => {
       success: true,
       output: {
         number: '{{NUMBER}}',
-        boolean: '{{BOOLEAN}}',
-        nothing: '{{NULL}}',
+        boolean: true,
+        nothing: null,
         numberText: '{{NUMBER}}',
-        booleanText: '{{BOOLEAN}}',
-        nilText: '{{NULL}}',
+        booleanText: 'true',
+        nilText: 'null',
       },
     })
   })
diff --git a/apps/sim/lib/copilot/request/tools/tables.test.ts b/apps/sim/lib/copilot/request/tools/tables.test.ts
index f75dbdde3f6..cc9faafbff9 100644
--- a/apps/sim/lib/copilot/request/tools/tables.test.ts
+++ b/apps/sim/lib/copilot/request/tools/tables.test.ts
@@ -569,7 +569,7 @@ describe('maybeWriteReadCsvToTable', () => {
               col_status: {
                 version: 1,
                 complete: true,
-                entries: [{ name: 'BOOLEAN', encryptedValue: 'encrypted-boolean' }],
+                entries: [],
                 scope: { userId: 'user-1', workspaceId: 'workspace-1' },
               },
             },
@@ -634,7 +634,7 @@ describe('maybeWriteReadCsvToTable', () => {
     )
   })
 
-  it('preserves numeric and boolean cells while recording their provenance', async () => {
+  it('preserves numeric and boolean cells, recording provenance only for the identifying one', async () => {
     const registry = new ResolvedSecretTraceRegistry(
       [
         { name: 'NUMBER', plaintext: '123', encryptedValue: 'encrypted-number' },
@@ -666,9 +666,7 @@ describe('maybeWriteReadCsvToTable', () => {
               col_age: expect.objectContaining({
                 entries: [{ name: 'NUMBER', encryptedValue: 'encrypted-number' }],
               }),
-              col_active: expect.objectContaining({
-                entries: [{ name: 'BOOLEAN', encryptedValue: 'encrypted-boolean' }],
-              }),
+              col_active: expect.objectContaining({ entries: [] }),
             }),
           }),
         ],
diff --git a/apps/sim/lib/copilot/tools/handlers/function-execute.ts b/apps/sim/lib/copilot/tools/handlers/function-execute.ts
index da324d58906..d6f04a63c33 100644
--- a/apps/sim/lib/copilot/tools/handlers/function-execute.ts
+++ b/apps/sim/lib/copilot/tools/handlers/function-execute.ts
@@ -528,12 +528,19 @@ export async function resolveInputFiles(
         })
         if (
           !provenance.complete ||
-          !(await resolvedSecretTraceRegistry.importProvenance(provenance, { trusted: true }))
+          !(await resolvedSecretTraceRegistry.importProvenance(provenance, {
+            trusted: true,
+            origin: 'copilotFunctionExecute.result',
+          }))
         ) {
-          resolvedSecretTraceRegistry.markIncomplete()
+          resolvedSecretTraceRegistry.markIncomplete('source-provenance-incomplete', {
+            origin: 'copilotFunctionExecute.result',
+          })
         }
       } catch {
-        resolvedSecretTraceRegistry.markIncomplete()
+        resolvedSecretTraceRegistry.markIncomplete('unspecified', {
+          origin: 'copilotFunctionExecute.result',
+        })
       }
 
       const columns = table.schema.columns
@@ -561,11 +568,13 @@ async function importMountedProvenance(
   try {
     const provenance = source.exportProvenanceForValue(crossingValue)
     const imported = await target.importCrossingProvenance(provenance, crossingValue, {
+      origin: 'copilotFunctionExecute.crossing',
       trusted: true,
     })
-    if (!imported) target.markIncomplete()
+    if (!imported)
+      target.markIncomplete('unspecified', { origin: 'copilotFunctionExecute.crossing' })
   } catch {
-    target.markIncomplete()
+    target.markIncomplete('unspecified', { origin: 'copilotFunctionExecute.crossing' })
   }
 }
 
diff --git a/apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts b/apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts
index 260bf73fbd2..dc74ef922ae 100644
--- a/apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts
+++ b/apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts
@@ -119,7 +119,7 @@ async function executeCopilotWorkflowTarget(params: {
       await params.context.resolvedSecretTraceRegistry.importCrossingProvenance(
         result.executionState?.resolvedSecretTraceProvenance,
         { output: result.output, logs: result.logs, error: result.error },
-        { trusted: true }
+        { trusted: true, origin: 'copilotWorkflowMutation.runCrossing' }
       )
     }
     return result
@@ -134,7 +134,7 @@ async function executeCopilotWorkflowTarget(params: {
           error: executionResult?.error,
           thrownMessage: toError(error).message,
         },
-        { trusted: true }
+        { trusted: true, origin: 'copilotWorkflowMutation.failedRunCrossing' }
       )
     }
     if (admission.targetReservation) {
diff --git a/apps/sim/lib/core/config/env.ts b/apps/sim/lib/core/config/env.ts
index e0fcf321283..e7aa17eab6b 100644
--- a/apps/sim/lib/core/config/env.ts
+++ b/apps/sim/lib/core/config/env.ts
@@ -21,6 +21,23 @@ const getEnv = (variable: string): string | undefined => {
   return window.__ENV?.[variable] ?? process.env[variable]
 }
 
+/**
+ * Whether `window.__ENV` was still unset when this module first evaluated in the
+ * browser. Always `false` on the server.
+ *
+ * Module bodies run inside the framework bootstrap, which an `async` chunk can
+ * start before the parser has reached the inline assignment at the end of
+ * `<head>`. Reads made during render are unaffected: nothing renders until the
+ * RSC payload arrives, and that streams from `<body>` — after the assignment.
+ * Module-scope reads have no such ordering, and the values they derive
+ * (`isHosted` and the other flags in `env-flags`) stay frozen for the session.
+ *
+ * Reported once per load so the rate is measurable rather than assumed; it is
+ * what decides whether those flags need to become lazy.
+ */
+export const publicEnvMissingAtModuleInit =
+  typeof window !== 'undefined' && window.__ENV === undefined
+
 // biome-ignore format: keep alignment for readability
 export const env = createEnv({
   skipValidation: true,
@@ -109,6 +126,7 @@ export const env = createEnv({
     PII_REDACTION:                         z.boolean().optional(),                 // Redact PII from workflow logs via configurable Data Retention rules (Presidio at the logger persist choke point) and expose the Data Retention config UI
     PII_GRANULAR_REDACTION:                z.boolean().optional(),                 // Expose the execution-altering PII redaction stages (redact workflow input + block outputs in-flight) in the Data Retention config; layered on top of PII_REDACTION
     TRIGGER_EU_REGION:                     z.boolean().optional(),                 // Route Trigger.dev runs to eu-central-1 instead of the default us-east-1 (fallback for the trigger-eu-region flag when AppConfig is not the source of truth)
+    DURABLE_SECRET_PROVENANCE_ENFORCED_SURFACES: z.string().optional(),            // Durable surfaces where unrecorded secret provenance fails the run instead of logging a warning: "all", or a comma-separated subset of memory,table-row,knowledge,workspace-file (default: none enforced)
 
     // Table feature limits (per plan). Apply when billing is disabled (free tier defaults) or for billed plans.
     FREE_TABLES_LIMIT:                     z.number().optional(),                  // Max user tables per workspace on free tier (default: 5)
diff --git a/apps/sim/lib/execution/durable-secret-provenance-enforcement.test.ts b/apps/sim/lib/execution/durable-secret-provenance-enforcement.test.ts
new file mode 100644
index 00000000000..46310bb9b29
--- /dev/null
+++ b/apps/sim/lib/execution/durable-secret-provenance-enforcement.test.ts
@@ -0,0 +1,92 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockEnv, mockLogger } = vi.hoisted(() => ({
+  mockEnv: {} as Record<string, string | undefined>,
+  mockLogger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+}))
+
+vi.mock('@/lib/core/config/env', () => ({ env: mockEnv }))
+vi.mock('@sim/logger', () => ({ createLogger: () => mockLogger }))
+
+import {
+  DURABLE_SECRET_PROVENANCE_SURFACES,
+  isDurableSecretProvenanceEnforced,
+  reportUnrecordedDurableProvenance,
+  resetDurableSecretProvenanceEnforcementCache,
+} from '@/lib/execution/durable-secret-provenance-enforcement'
+
+function configure(value: string | undefined): void {
+  mockEnv.DURABLE_SECRET_PROVENANCE_ENFORCED_SURFACES = value
+  resetDurableSecretProvenanceEnforcementCache()
+}
+
+describe('durable secret provenance enforcement', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    configure(undefined)
+  })
+
+  it('enforces nothing by default, so unrecorded provenance warns instead of latching', () => {
+    for (const surface of DURABLE_SECRET_PROVENANCE_SURFACES) {
+      expect(isDurableSecretProvenanceEnforced(surface)).toBe(false)
+    }
+  })
+
+  it('closes one surface at a time without touching the others', () => {
+    configure('table-row')
+
+    expect(isDurableSecretProvenanceEnforced('table-row')).toBe(true)
+    expect(isDurableSecretProvenanceEnforced('memory')).toBe(false)
+    expect(isDurableSecretProvenanceEnforced('knowledge')).toBe(false)
+  })
+
+  it('accepts a comma-separated subset, ignoring case and padding', () => {
+    configure(' Memory , TABLE-ROW ')
+
+    expect(isDurableSecretProvenanceEnforced('memory')).toBe(true)
+    expect(isDurableSecretProvenanceEnforced('table-row')).toBe(true)
+    expect(isDurableSecretProvenanceEnforced('knowledge')).toBe(false)
+  })
+
+  it('closes every surface on "all"', () => {
+    configure('all')
+
+    for (const surface of DURABLE_SECRET_PROVENANCE_SURFACES) {
+      expect(isDurableSecretProvenanceEnforced(surface)).toBe(true)
+    }
+  })
+
+  it('reports an unrecognized surface rather than silently enforcing nothing', () => {
+    configure('memory,workspace-file')
+
+    expect(isDurableSecretProvenanceEnforced('memory')).toBe(true)
+    expect(mockLogger.error).toHaveBeenCalledWith(
+      'Ignoring unrecognized durable secret provenance surfaces',
+      expect.objectContaining({ unrecognized: ['workspace-file'] })
+    )
+  })
+
+  it('reports at error with the surface, cause, and affected count so it survives every LOG_LEVEL default', () => {
+    reportUnrecordedDurableProvenance({
+      surface: 'table-row',
+      cause: 'row-sidecar-not-exact',
+      affectedCount: 8,
+      workspaceId: 'workspace-1',
+    })
+
+    expect(mockLogger.warn).not.toHaveBeenCalled()
+    expect(mockLogger.error).toHaveBeenCalledWith(
+      'Proceeding on unrecorded durable secret provenance',
+      {
+        surface: 'table-row',
+        cause: 'row-sidecar-not-exact',
+        enforced: false,
+        affectedCount: 8,
+        workspaceId: 'workspace-1',
+      }
+    )
+  })
+})
diff --git a/apps/sim/lib/execution/durable-secret-provenance-enforcement.ts b/apps/sim/lib/execution/durable-secret-provenance-enforcement.ts
new file mode 100644
index 00000000000..8489ab66424
--- /dev/null
+++ b/apps/sim/lib/execution/durable-secret-provenance-enforcement.ts
@@ -0,0 +1,106 @@
+import { createLogger } from '@sim/logger'
+import { env } from '@/lib/core/config/env'
+
+const logger = createLogger('DurableSecretProvenanceEnforcement')
+
+/**
+ * Durable stores that can hand a run a value whose secret provenance was never recorded.
+ *
+ * Named by the call site rather than derived, so the surface survives refactors and stays
+ * greppable — the same convention the projection-refusal `site` strings use.
+ */
+export const DURABLE_SECRET_PROVENANCE_SURFACES = ['memory', 'table-row', 'knowledge'] as const
+
+export type DurableSecretProvenanceSurface = (typeof DURABLE_SECRET_PROVENANCE_SURFACES)[number]
+
+/** Reads the configured surfaces once; an unrecognized name is reported rather than assumed. */
+function resolveEnforcedSurfaces(): ReadonlySet<DurableSecretProvenanceSurface> {
+  const configured = env.DURABLE_SECRET_PROVENANCE_ENFORCED_SURFACES?.trim()
+  if (!configured) return new Set()
+
+  const requested = configured
+    .split(',')
+    .map((entry) => entry.trim().toLowerCase())
+    .filter((entry) => entry.length > 0)
+  if (requested.includes('all')) return new Set(DURABLE_SECRET_PROVENANCE_SURFACES)
+
+  const enforced = new Set<DurableSecretProvenanceSurface>()
+  const unrecognized: string[] = []
+  for (const entry of requested) {
+    const surface = DURABLE_SECRET_PROVENANCE_SURFACES.find((candidate) => candidate === entry)
+    if (surface) enforced.add(surface)
+    else unrecognized.push(entry)
+  }
+  if (unrecognized.length > 0) {
+    logger.error('Ignoring unrecognized durable secret provenance surfaces', {
+      unrecognized,
+      supported: [...DURABLE_SECRET_PROVENANCE_SURFACES],
+    })
+  }
+  return enforced
+}
+
+let enforcedSurfaces: ReadonlySet<DurableSecretProvenanceSurface> | undefined
+
+/**
+ * True when unrecorded provenance from this surface must fail the run rather than warn.
+ *
+ * Nothing is enforced by default. `unknown` provenance means "nobody recorded what secrets this
+ * value carries", which is the same thing a pre-tracking legacy row says — and legacy rows are read
+ * as carrying none. Enforcing one and not the other made an *aware* writer that momentarily could
+ * not vouch strictly worse than an unaware one: the row it wrote latched every run that later read
+ * it, and each latched run wrote more such rows, so a workspace could not recover without a data
+ * repair.
+ *
+ * Warning instead keeps that state visible and measurable while the writers that produce it are
+ * fixed. The sidecar still records `unknown` faithfully, so a surface can be closed back up once
+ * its writers stop losing provenance — and the rows that will start failing are countable from the
+ * sidecar table before the switch is thrown. This is a deliberate posture: an unenforced surface
+ * can under-redact a value whose provenance was lost.
+ *
+ * Set `DURABLE_SECRET_PROVENANCE_ENFORCED_SURFACES` to `all`, or to a comma-separated subset of
+ * {@link DURABLE_SECRET_PROVENANCE_SURFACES}, to close a surface.
+ *
+ * Workspace files are deliberately not a surface here: their unknown check sits in the callers
+ * rather than in the shared import, and one unknown file locks vfs reads, chat attachments, sandbox
+ * mounts, and the file tool routes at once. They stay fail-closed until that is its own decision.
+ */
+export function isDurableSecretProvenanceEnforced(
+  surface: DurableSecretProvenanceSurface
+): boolean {
+  enforcedSurfaces ??= resolveEnforcedSurfaces()
+  return enforcedSurfaces.has(surface)
+}
+
+export interface UnrecordedDurableProvenanceReport {
+  surface: DurableSecretProvenanceSurface
+  /** What the surface could not vouch for, e.g. `sidecar-status-unknown`. Always a static literal. */
+  cause: string
+  /** How many records in this one read were unrecorded, when the caller reads a page at a time. */
+  affectedCount?: number
+  workspaceId?: string
+}
+
+/**
+ * Records that a read proceeded on provenance nobody wrote down.
+ *
+ * Error, not warn, for the same reason the originating-fault reasons use it: error is the only
+ * level that survives every default the logger falls back to — production, test, and a self-hosted
+ * chart that sets no `LOG_LEVEL`. A surface stays open on the strength of this line being visible
+ * and trending to zero, so a level that a deployment can silently filter would leave the posture
+ * unmeasured. It is deliberately noisy on an affected workspace; that is the signal.
+ */
+export function reportUnrecordedDurableProvenance(report: UnrecordedDurableProvenanceReport): void {
+  logger.error('Proceeding on unrecorded durable secret provenance', {
+    surface: report.surface,
+    cause: report.cause,
+    enforced: false,
+    ...(report.affectedCount !== undefined ? { affectedCount: report.affectedCount } : {}),
+    ...(report.workspaceId ? { workspaceId: report.workspaceId } : {}),
+  })
+}
+
+/** Test seam: forces the next read to re-resolve the env-configured surfaces. */
+export function resetDurableSecretProvenanceEnforcementCache(): void {
+  enforcedSurfaces = undefined
+}
diff --git a/apps/sim/lib/execution/durable-secret-provenance.test.ts b/apps/sim/lib/execution/durable-secret-provenance.test.ts
index 75d75d22d38..00a29654067 100644
--- a/apps/sim/lib/execution/durable-secret-provenance.test.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance.test.ts
@@ -1,12 +1,26 @@
 /**
  * @vitest-environment node
  */
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockIsEnforced, mockReport } = vi.hoisted(() => ({
+  mockIsEnforced: vi.fn(() => false),
+  mockReport: vi.fn(),
+}))
+
+vi.mock('@/lib/execution/durable-secret-provenance-enforcement', () => ({
+  DURABLE_SECRET_PROVENANCE_SURFACES: ['memory', 'table-row', 'knowledge'],
+  isDurableSecretProvenanceEnforced: mockIsEnforced,
+  reportUnrecordedDurableProvenance: mockReport,
+}))
+
 import {
   durableSecretProvenanceFromPrivateBundle,
   filterDurableSecretProvenanceBySourceValues,
   hashDurableSecretProvenanceValue,
+  importDurableSecretProvenance,
 } from '@/lib/execution/durable-secret-provenance'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 function privateBundle(scope?: { userId: string; workspaceId?: string }) {
   return {
@@ -133,3 +147,54 @@ describe('private durable provenance scope admission', () => {
     ).toBeUndefined()
   })
 })
+
+describe('importing unrecorded durable provenance', () => {
+  const UNKNOWN = { status: 'unknown' } as const
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockIsEnforced.mockReturnValue(false)
+  })
+
+  it('warns and leaves the registry able to vouch when the surface is not enforced', async () => {
+    const registry = new ResolvedSecretTraceRegistry()
+
+    await expect(
+      importDurableSecretProvenance(registry, UNKNOWN, undefined, 'memory')
+    ).resolves.toBe(true)
+    expect(registry.isPermanentlyIncomplete()).toBe(false)
+    expect(mockReport).toHaveBeenCalledWith({
+      surface: 'memory',
+      cause: 'durable-provenance-unknown',
+    })
+  })
+
+  it('latches the registry once that surface is closed', async () => {
+    mockIsEnforced.mockReturnValue(true)
+    const registry = new ResolvedSecretTraceRegistry()
+
+    await expect(
+      importDurableSecretProvenance(registry, UNKNOWN, undefined, 'memory')
+    ).resolves.toBe(false)
+    expect(registry.isPermanentlyIncomplete()).toBe(true)
+    expect(mockReport).not.toHaveBeenCalled()
+  })
+
+  it('latches for a caller that has not declared a surface', async () => {
+    const registry = new ResolvedSecretTraceRegistry()
+
+    await expect(importDurableSecretProvenance(registry, UNKNOWN)).resolves.toBe(false)
+    expect(registry.isPermanentlyIncomplete()).toBe(true)
+  })
+
+  it('never relaxes a malformed sidecar, which is a fault rather than missing data', async () => {
+    const registry = new ResolvedSecretTraceRegistry()
+    const malformed = { status: 'exact', entries: [{ encryptedValue: '' }] } as never
+
+    await expect(
+      importDurableSecretProvenance(registry, malformed, undefined, 'memory')
+    ).resolves.toBe(false)
+    expect(registry.isPermanentlyIncomplete()).toBe(true)
+    expect(mockReport).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/lib/execution/durable-secret-provenance.ts b/apps/sim/lib/execution/durable-secret-provenance.ts
index 334f4cfa07d..724f0ac340d 100644
--- a/apps/sim/lib/execution/durable-secret-provenance.ts
+++ b/apps/sim/lib/execution/durable-secret-provenance.ts
@@ -1,5 +1,10 @@
 import { createHash } from 'node:crypto'
 import type { DurableSecretProvenanceEntry } from '@sim/db/schema'
+import {
+  type DurableSecretProvenanceSurface,
+  isDurableSecretProvenanceEnforced,
+  reportUnrecordedDurableProvenance,
+} from '@/lib/execution/durable-secret-provenance-enforcement'
 import {
   isPrivateSecretProvenanceBundleV1,
   type PrivateSecretProvenanceBundleV1,
@@ -191,19 +196,34 @@ export function filterDurableSecretProvenanceBySourceValues(
   return entries ? { status: 'exact', entries } : { status: 'unknown' }
 }
 
-/** Imports durable entries into a model-bound registry, preserving source-scope anonymity. */
+/**
+ * Imports durable entries into a model-bound registry, preserving source-scope anonymity.
+ *
+ * `surface` selects the enforcement policy for provenance nobody recorded. Omitting it enforces,
+ * which is the right default for a caller that has not been reviewed against
+ * {@link isDurableSecretProvenanceEnforced} yet.
+ */
 export async function importDurableSecretProvenance(
   registry: ResolvedSecretTraceRegistry,
   provenance: DurableSecretProvenance,
-  value?: unknown
+  value?: unknown,
+  surface?: DurableSecretProvenanceSurface
 ): Promise<boolean> {
   if (provenance.status === 'unknown') {
-    registry.markIncomplete()
+    if (surface && !isDurableSecretProvenanceEnforced(surface)) {
+      reportUnrecordedDurableProvenance({ surface, cause: 'durable-provenance-unknown' })
+      return true
+    }
+    registry.markIncomplete('durable-provenance-unknown')
     return false
   }
   const entries = normalizeDurableSecretProvenanceEntries(provenance.entries)
   if (!entries) {
-    registry.markIncomplete()
+    /**
+     * Malformed is not unrecorded: a sidecar that exists but cannot be parsed is a fault, and no
+     * enforcement policy relaxes it.
+     */
+    registry.markIncomplete('durable-provenance-malformed')
     return false
   }
 
@@ -236,8 +256,14 @@ export async function importDurableSecretProvenance(
     }
     const imported =
       value === undefined
-        ? await registry.importProvenance(envelope, { trusted: true })
-        : await registry.importProvenanceForValue(envelope, value, { trusted: true })
+        ? await registry.importProvenance(envelope, {
+            trusted: true,
+            origin: 'durableProvenance.envelope',
+          })
+        : await registry.importProvenanceForValue(envelope, value, {
+            trusted: true,
+            origin: 'durableProvenance.valueEnvelope',
+          })
     complete = imported && complete
   }
   return complete && !registry.isPermanentlyIncomplete()
diff --git a/apps/sim/lib/guardrails/validate_hallucination.ts b/apps/sim/lib/guardrails/validate_hallucination.ts
index 7185236baaf..155af832993 100644
--- a/apps/sim/lib/guardrails/validate_hallucination.ts
+++ b/apps/sim/lib/guardrails/validate_hallucination.ts
@@ -143,6 +143,7 @@ async function queryKnowledgeBase(
       functionalResponse = { ...payload }
       delete functionalResponse[RESOLVED_SECRET_PROVENANCE_FIELD]
       const imported = await resultRegistry.importProvenance(inspection.value, {
+        origin: 'guardrails.hallucinationResult',
         trusted: true,
       })
       if (!imported || !resultRegistry.isComplete()) {
diff --git a/apps/sim/lib/knowledge/model-input-provenance.ts b/apps/sim/lib/knowledge/model-input-provenance.ts
index af4ea906476..30fbfe8f706 100644
--- a/apps/sim/lib/knowledge/model-input-provenance.ts
+++ b/apps/sim/lib/knowledge/model-input-provenance.ts
@@ -65,6 +65,7 @@ export async function prepareKnowledgeModelInputProvenance(options: {
   }
 
   const imported = await registry.importProvenanceForValue(inspection.value, options.modelInput, {
+    origin: 'knowledge.modelInputProvenance',
     trusted: true,
   })
   if (!imported || !registry.isComplete()) {
diff --git a/apps/sim/lib/knowledge/secret-provenance.ts b/apps/sim/lib/knowledge/secret-provenance.ts
index 03802733807..139fb0adc44 100644
--- a/apps/sim/lib/knowledge/secret-provenance.ts
+++ b/apps/sim/lib/knowledge/secret-provenance.ts
@@ -409,7 +409,7 @@ export async function loadKnowledgeDocumentSecretRegistry(
       tracked: row.secretProvenanceVersion === 1 || currentSourceFileProvenance !== undefined,
     }
   const registry = new ResolvedSecretTraceRegistry([], scope)
-  if (!(await importDurableSecretProvenance(registry, provenance))) {
+  if (!(await importDurableSecretProvenance(registry, provenance, undefined, 'knowledge'))) {
     throw new Error('Knowledge document secret provenance is unavailable')
   }
   return { registry, provenance, tracked: true }
@@ -503,7 +503,9 @@ export async function importKnowledgePersistedResponseSecretProvenance(options:
       readBoundKnowledgeDocumentSecretProvenance({ ...row, source }),
       source
     )
-    if (!(await importDurableSecretProvenance(options.registry, provenance, item.value))) {
+    if (
+      !(await importDurableSecretProvenance(options.registry, provenance, item.value, 'knowledge'))
+    ) {
       return false
     }
   }
@@ -515,7 +517,9 @@ export async function importKnowledgePersistedResponseSecretProvenance(options:
       return false
     }
     const provenance = readBoundKnowledgeEmbeddingSecretProvenance(row)
-    if (!(await importDurableSecretProvenance(options.registry, provenance, item.value))) {
+    if (
+      !(await importDurableSecretProvenance(options.registry, provenance, item.value, 'knowledge'))
+    ) {
       return false
     }
   }
@@ -567,7 +571,14 @@ export async function importKnowledgeSearchResultSecretProvenance(options: {
       return { imported: false, documentMetadata: {} }
     }
     const provenance = readBoundKnowledgeEmbeddingSecretProvenance(row)
-    if (!(await importDurableSecretProvenance(options.registry, provenance, result.content))) {
+    if (
+      !(await importDurableSecretProvenance(
+        options.registry,
+        provenance,
+        result.content,
+        'knowledge'
+      ))
+    ) {
       return { imported: false, documentMetadata: {} }
     }
   }
diff --git a/apps/sim/lib/logs/execution/logging-session.ts b/apps/sim/lib/logs/execution/logging-session.ts
index d6b51552096..ced3101d10c 100644
--- a/apps/sim/lib/logs/execution/logging-session.ts
+++ b/apps/sim/lib/logs/execution/logging-session.ts
@@ -316,7 +316,10 @@ export class LoggingSession {
     }
 
     const registry = new ResolvedSecretTraceRegistry([], provenance.scope)
-    await registry.importProvenance(provenance, { trusted: true })
+    await registry.importProvenance(provenance, {
+      trusted: true,
+      origin: 'loggingSession.restoredProvenance',
+    })
     return registry
   }
 
diff --git a/apps/sim/lib/logs/execution/trace-store.ts b/apps/sim/lib/logs/execution/trace-store.ts
index 031d86216d0..9fa5a7b05df 100644
--- a/apps/sim/lib/logs/execution/trace-store.ts
+++ b/apps/sim/lib/logs/execution/trace-store.ts
@@ -275,7 +275,10 @@ export async function projectExecutionDataForDisplay(
 
   if (isResolvedSecretTraceProvenanceV1(provenance)) {
     registry = new ResolvedSecretTraceRegistry([], provenance.scope)
-    await registry.importProvenance(provenance, { trusted: true })
+    await registry.importProvenance(provenance, {
+      trusted: true,
+      origin: 'traceStore.spanProvenance',
+    })
   }
 
   const projectionStore = {
@@ -301,9 +304,12 @@ export async function projectExecutionDataForDisplay(
       ? new ResolvedSecretTraceRegistry([], exactProvenance.scope)
       : new ResolvedSecretTraceRegistry()
     if (isResolvedSecretTraceProvenanceV1(exactProvenance)) {
-      await exactRegistry.importProvenance(exactProvenance, { trusted: true })
+      await exactRegistry.importProvenance(exactProvenance, {
+        trusted: true,
+        origin: 'traceStore.exactProvenance',
+      })
     } else {
-      exactRegistry.markIncomplete()
+      exactRegistry.markIncomplete('untrusted-provenance', { origin: 'traceStore.exactProvenance' })
     }
 
     const [projected] = await projectTraceSpansForSecrets(
diff --git a/apps/sim/lib/table/backfill-runner.ts b/apps/sim/lib/table/backfill-runner.ts
index c9041f84b87..1d549397ed5 100644
--- a/apps/sim/lib/table/backfill-runner.ts
+++ b/apps/sim/lib/table/backfill-runner.ts
@@ -82,7 +82,10 @@ export async function createBackfillExecutionSecretRegistry(options: {
     registry.markIncomplete()
     return registry
   }
-  await registry.importProvenance(provenance, { trusted: true })
+  await registry.importProvenance(provenance, {
+    trusted: true,
+    origin: 'tableBackfill.rowProvenance',
+  })
   return registry
 }
 
diff --git a/apps/sim/lib/table/rows/secret-provenance.test.ts b/apps/sim/lib/table/rows/secret-provenance.test.ts
index 20240b69f2a..c9f0a948a55 100644
--- a/apps/sim/lib/table/rows/secret-provenance.test.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.test.ts
@@ -5,6 +5,18 @@ import { userTableDefinitions, userTableRows } from '@sim/db/schema'
 import { dbChainMock, dbChainMockFns, queueTableRows, resetDbChainMock } from '@sim/testing'
 import { eq } from 'drizzle-orm'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockIsEnforced, mockReport } = vi.hoisted(() => ({
+  mockIsEnforced: vi.fn(() => false),
+  mockReport: vi.fn(),
+}))
+
+vi.mock('@/lib/execution/durable-secret-provenance-enforcement', () => ({
+  DURABLE_SECRET_PROVENANCE_SURFACES: ['memory', 'table-row', 'knowledge'],
+  isDurableSecretProvenanceEnforced: mockIsEnforced,
+  reportUnrecordedDurableProvenance: mockReport,
+}))
+
 import type { DbTransaction } from '@/lib/table/planner'
 import {
   classifyTableRowSecretProvenanceForCopy,
@@ -46,6 +58,7 @@ describe('table row secret provenance', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    mockIsEnforced.mockReturnValue(false)
   })
 
   it('checks a version-pinned table with one bounded unsafe-row query', async () => {
@@ -204,7 +217,8 @@ describe('table row secret provenance', () => {
     })
   })
 
-  it('fails closed for stale tracked rows instead of returning partial provenance', async () => {
+  it('fails closed for stale tracked rows once the table-row surface is enforced', async () => {
+    mockIsEnforced.mockReturnValue(true)
     queueTableRows(userTableRows, [
       {
         id: 'tracked-row',
@@ -230,6 +244,62 @@ describe('table row secret provenance', () => {
     })
   })
 
+  /**
+   * The shape that broke production: one unrecorded row in a page voided the whole read, and a
+   * page is what a `query_rows` block hands downstream, so every later model boundary refused.
+   */
+  it('keeps a page readable when one row is unrecorded, without dropping its siblings', async () => {
+    queueTableRows(userTableRows, [
+      {
+        id: 'unknown-row',
+        updatedAt: ROW_UPDATED_AT,
+        secretProvenanceVersion: 1,
+        sidecarRowId: 'unknown-row',
+        sidecarStatus: 'unknown',
+        sidecarEntries: [],
+        sidecarIsCurrent: true,
+      },
+      {
+        id: 'tracked-row',
+        updatedAt: ROW_UPDATED_AT,
+        secretProvenanceVersion: 1,
+        sidecarRowId: 'tracked-row',
+        sidecarStatus: 'exact',
+        sidecarEntries: [
+          {
+            columnId: 'secret-column',
+            encryptedValue: 'encrypted-local',
+            name: 'LOCAL_SECRET',
+            sourceUserId: 'user-1',
+            sourceWorkspaceId: 'workspace-1',
+          },
+        ],
+        sidecarIsCurrent: true,
+      },
+    ])
+
+    await expect(
+      loadTableRowSecretProvenance(
+        [
+          { id: 'unknown-row', updatedAt: ROW_UPDATED_AT },
+          { id: 'tracked-row', updatedAt: ROW_UPDATED_AT },
+        ],
+        { userId: 'user-1', workspaceId: 'workspace-1' }
+      )
+    ).resolves.toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ encryptedValue: 'encrypted-local', name: 'LOCAL_SECRET' }],
+      scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+    })
+    expect(mockReport).toHaveBeenCalledWith({
+      surface: 'table-row',
+      cause: 'row-sidecar-not-exact',
+      affectedCount: 1,
+      workspaceId: 'workspace-1',
+    })
+  })
+
   it('rejects contradictory duplicate row crossings before reading provenance', async () => {
     await expect(
       loadTableRowSecretProvenance(
diff --git a/apps/sim/lib/table/rows/secret-provenance.ts b/apps/sim/lib/table/rows/secret-provenance.ts
index 126c3c8ea84..7ea7291107f 100644
--- a/apps/sim/lib/table/rows/secret-provenance.ts
+++ b/apps/sim/lib/table/rows/secret-provenance.ts
@@ -6,6 +6,10 @@ import {
   userTableRows,
 } from '@sim/db/schema'
 import { and, asc, eq, gt, inArray, type SQL, sql } from 'drizzle-orm'
+import {
+  isDurableSecretProvenanceEnforced,
+  reportUnrecordedDurableProvenance,
+} from '@/lib/execution/durable-secret-provenance-enforcement'
 import type { DbExecutor, DbTransaction } from '@/lib/table/planner'
 import type { RowData, TableRowSecretProvenanceWrite } from '@/lib/table/types'
 import {
@@ -252,7 +256,13 @@ export async function createTableRowSecretProvenanceFromEncryptedExecution(
     return createUnknownTableRowSecretProvenance()
   }
   const registry = new ResolvedSecretTraceRegistry([], provenance.scope)
-  if (!(await registry.importProvenance(provenance, { trusted: true })) || !registry.isComplete()) {
+  if (
+    !(await registry.importProvenance(provenance, {
+      trusted: true,
+      origin: 'tableRow.encryptedExecution',
+    })) ||
+    !registry.isComplete()
+  ) {
     return createUnknownTableRowSecretProvenance()
   }
   return createTableRowSecretProvenanceFromRegistry(data, registry)
@@ -765,6 +775,7 @@ export async function loadTableRowSecretProvenance(
   const currentById = new Map(currentRows.map((row) => [row.id, row]))
   const storedEntries: StoredTableRowSecretProvenanceEntry[] = []
 
+  let unrecordedRowCount = 0
   for (const rowId of rowIds) {
     const current = currentById.get(rowId)
     const crossing = crossingById.get(rowId)
@@ -777,7 +788,16 @@ export async function loadTableRowSecretProvenance(
       current.sidecarStatus !== 'exact' ||
       !current.sidecarIsCurrent
     ) {
-      return { version: 1, complete: false, entries: [], scope }
+      /**
+       * One such row would otherwise void the whole page, and a page is what a `query_rows` block
+       * hands downstream — so a single row nobody recorded provenance for latched every run that
+       * read the table. Unenforced, the row contributes nothing, exactly like the legacy row above.
+       */
+      if (isDurableSecretProvenanceEnforced('table-row')) {
+        return { version: 1, complete: false, entries: [], scope }
+      }
+      unrecordedRowCount += 1
+      continue
     }
     const parsed = normalizeStoredEntries(current.sidecarEntries)
     if (!parsed) return { version: 1, complete: false, entries: [], scope }
@@ -791,6 +811,15 @@ export async function loadTableRowSecretProvenance(
     }
   }
 
+  if (unrecordedRowCount > 0) {
+    reportUnrecordedDurableProvenance({
+      surface: 'table-row',
+      cause: 'row-sidecar-not-exact',
+      affectedCount: unrecordedRowCount,
+      ...(scope.workspaceId ? { workspaceId: scope.workspaceId } : {}),
+    })
+  }
+
   const entries = aggregateStoredEntries(storedEntries, scope)
   if (!entries) return { version: 1, complete: false, entries: [], scope }
   const provenance: ResolvedSecretTraceProvenanceV1 = {
diff --git a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts
index a565b08510b..124c66e0337 100644
--- a/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/workspace-file-secret-provenance.test.ts
@@ -450,7 +450,7 @@ describe('workspace file secret provenance', () => {
         ],
         scope: { userId: 'user-1' },
       },
-      { trusted: true }
+      { trusted: true, origin: 'durableProvenance.envelope' }
     )
 
     queueTableRows(workspaceFiles, [
@@ -488,7 +488,7 @@ describe('workspace file secret provenance', () => {
         ],
         scope: { userId: 'user-1' },
       },
-      { trusted: true }
+      { trusted: true, origin: 'durableProvenance.envelope' }
     )
 
     queueTableRows(workspaceFiles, [
@@ -523,7 +523,7 @@ describe('workspace file secret provenance', () => {
         entries: [{ encryptedValue: 'anonymous-encrypted' }],
         scope: { userId: 'user-1' },
       },
-      { trusted: true }
+      { trusted: true, origin: 'durableProvenance.envelope' }
     )
 
     queueTableRows(workspaceFiles, [
@@ -583,7 +583,7 @@ describe('workspace file secret provenance', () => {
         ],
         scope: { userId: 'user-1' },
       },
-      { trusted: true }
+      { trusted: true, origin: 'durableProvenance.envelope' }
     )
   })
 
@@ -669,7 +669,7 @@ describe('workspace file secret provenance', () => {
         scope: { userId: 'user-1' },
       },
       'derived text',
-      { trusted: true }
+      { trusted: true, origin: 'durableProvenance.valueEnvelope' }
     )
   })
 
diff --git a/apps/sim/lib/workflows/executor/execution-core.ts b/apps/sim/lib/workflows/executor/execution-core.ts
index 90af6185620..aa1fd9094f5 100644
--- a/apps/sim/lib/workflows/executor/execution-core.ts
+++ b/apps/sim/lib/workflows/executor/execution-core.ts
@@ -544,7 +544,7 @@ async function executeWorkflowCoreImpl(
     if (options.trustedInitialResolvedSecretTraceProvenance !== undefined) {
       await resolvedSecretTraceRegistry.importProvenance(
         options.trustedInitialResolvedSecretTraceProvenance,
-        { trusted: true }
+        { trusted: true, origin: 'executionCore.initialProvenance' }
       )
     }
     loggingSession.setResolvedSecretTraceRegistry(resolvedSecretTraceRegistry)
diff --git a/apps/sim/lib/workflows/executor/input-secret-provenance.ts b/apps/sim/lib/workflows/executor/input-secret-provenance.ts
index bc93c6f4ec4..ecfbc83e1ed 100644
--- a/apps/sim/lib/workflows/executor/input-secret-provenance.ts
+++ b/apps/sim/lib/workflows/executor/input-secret-provenance.ts
@@ -85,7 +85,10 @@ export async function resolveWorkflowInputSecretProvenance(options: {
   }
 
   const sourceRegistry = new ResolvedSecretTraceRegistry([], provenance.scope)
-  const imported = await sourceRegistry.importProvenance(provenance, { trusted: true })
+  const imported = await sourceRegistry.importProvenance(provenance, {
+    trusted: true,
+    origin: 'executionInput.secretProvenance',
+  })
   const inputProvenance = sourceRegistry.exportProvenanceForValue(options.input)
   if (
     !imported ||
diff --git a/apps/sim/providers/runtime-context.test.ts b/apps/sim/providers/runtime-context.test.ts
index de6bed10577..c2919d7f4bc 100644
--- a/apps/sim/providers/runtime-context.test.ts
+++ b/apps/sim/providers/runtime-context.test.ts
@@ -393,7 +393,7 @@ describe('provider runtime context', () => {
     expect(result.output).toBe('{{TOKEN}}')
   })
 
-  it.each(['123', 'true'])(
+  it.each(['123'])(
     'leaves non-model resource metadata untouched while projecting content (%s)',
     async (secret) => {
       const registry = new ResolvedSecretTraceRegistry([
diff --git a/apps/sim/public/library/what-is-an-agentic-workflow/cover.jpg b/apps/sim/public/library/what-is-an-agentic-workflow/cover.jpg
new file mode 100644
index 00000000000..8d069b7ba4d
Binary files /dev/null and b/apps/sim/public/library/what-is-an-agentic-workflow/cover.jpg differ
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index 22981884f81..6e36e73d284 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -1187,7 +1187,8 @@ function consumeResolvedSecretNames(
 
 async function consumeResolvedSecretProvenance(
   payload: unknown,
-  registry?: ResolvedSecretTraceRegistry
+  registry: ResolvedSecretTraceRegistry | undefined,
+  toolId: string
 ): Promise<boolean> {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false
 
@@ -1202,6 +1203,7 @@ async function consumeResolvedSecretProvenance(
   const targetRegistry = registry.forkForToolCall()
   const imported = await targetRegistry.importCrossingProvenance(provenance, response, {
     trusted: true,
+    origin: `tool.${toolId}`,
   })
   if (!imported) return false
   registry.mergeToolCallRegistry(targetRegistry)
@@ -1249,7 +1251,8 @@ async function consumePrivateToolPayloadMetadata(
   headers: Headers,
   requestedType: PrivateToolMetadataType | undefined,
   params: Record<string, any>,
-  registry?: ResolvedSecretTraceRegistry
+  registry: ResolvedSecretTraceRegistry | undefined,
+  toolId: string
 ): Promise<PrivateToolMetadataConsumption> {
   if (!requestedType) return 'verified'
 
@@ -1308,7 +1311,7 @@ async function consumePrivateToolPayloadMetadata(
     ) {
       if (!consumeResolvedSecretNames(record, params, registry)) return 'invalid'
     } else {
-      if (!(await consumeResolvedSecretProvenance(record, registry))) return 'invalid'
+      if (!(await consumeResolvedSecretProvenance(record, registry, toolId))) return 'invalid'
     }
   } catch {
     return 'invalid'
@@ -1323,7 +1326,8 @@ async function consumePrivateToolResponseMetadata(
   response: Response,
   requestedType: PrivateToolMetadataType | undefined,
   params: Record<string, any>,
-  registry?: ResolvedSecretTraceRegistry
+  registry: ResolvedSecretTraceRegistry | undefined,
+  toolId: string
 ): Promise<PrivateToolResponseMetadataResult> {
   if (!requestedType) return { response }
 
@@ -1347,7 +1351,8 @@ async function consumePrivateToolResponseMetadata(
     response.headers,
     requestedType,
     params,
-    registry
+    registry,
+    toolId
   )
   if (consumption === 'invalid') {
     return { response: rebuildSafePrivateToolResponse(response) }
@@ -2512,7 +2517,8 @@ async function executeToolRequest(
       response,
       privateToolMetadataType,
       params,
-      resolvedSecretTraceRegistry
+      resolvedSecretTraceRegistry,
+      toolId
     )
     response = privateMetadata.response
 
@@ -2938,7 +2944,8 @@ async function executeMcpTool(
         response,
         privateToolMetadataType,
         params,
-        resolvedSecretTraceRegistry
+        resolvedSecretTraceRegistry,
+        toolId
       )
     ).response