[cevheri]

Phase A1 + the honesty half of A2 from the roadmap. Nine live runs on 2026-08-12 produced zero visible output between them; this is why.

What was wrong

conclude() is every terminal path's single exit, and it held both missing pieces while writing neither:

await service.finish(runId, status);              // stopReason and text dropped here
return { runId, status, stopReason, turns, text };

Planning mode — the default — called the model, received a plan, and discarded it. Its whole ledger was two events. Agent runs read the database competently and ended succeeded with the answer nowhere.

What changed

closing-statement carries the model's prose, under its own event kind rather than a lenient report-composed. It cites nothing and claims nothing, and that is the point: planning mode has no tools, so it can never produce evidence and could never have composed a report — being unable to speak at all was the consequence. Written only when the prose is non-empty.

stopReason on run-finished — report-composed | model-stopped | cancelled | deadline-exceeded | turn-limit. This is what separates succeeded from answered. A run that stops without composing now says so in the rail rather than presenting silence as success. It sits beside reason (why a drive died outside the loop); reason wins when both are present, since a dead drive is the more specific account.

finish takes an ending object rather than two positional optionals of different unions.

What it deliberately does not do

It does not demote an unanswered run to failed. The terminal vocabulary has no partial, and a planning run that produced a good plan did not fail. Making the ending legible is the precondition for that policy call, not the call itself.

Two guards, both earned

• The store's event-kind whitelist was a hand-written array of the union's own type — which does not catch an omission. Adding closing-statement left it behind, and the first run to write one made its own ledger unreadable: the validator rejected an event the writer had just appended. Derived from a total record now, so the next kind fails typecheck instead.
• STOP_SENTENCES is total over the stop-reason union, so a reason added later cannot reach a user as an unlabelled ending.

Verification

Live against the dev server with Gemini, planning mode:

Run opened in planning mode
Run started in planning mode
Closing statement — "To determine which departments have the highest average salary…
                    I would follow a systematic investigation plan: 1. Inspect the Schema…"
Run succeeded — "The model stopped without composing a cited report."

Six local gates green, coverage 100% (33711/33711).

[cevheri]

A3 pushed to this branch (97c97df)

Six distinct failures were reaching the rail as three labels, and the collapse hid the only one a user can act on without an operator.

A live run found it. A Gemini free-tier quota — 15 requests a minute — was exhausted by a morning of testing, and the rail said the provider "is not configured or could not be reached". It was configured, and had answered seconds earlier; it had asked for less traffic and named the wait (54.6s). The user was sent to a settings screen to fix something that fixes itself.

AgentRunFailureReason gains three members:

Reason	Next move
model-rate-limited	Wait — clears on its own
model-unauthorized	Fix the key; retrying will not help
engine-unsupported	Investigate a different connection

engine-unsupported matters more than it looks: it is the LibreDB sample, which is the default connection of a zero-config deployment. Phase 1 targets PostgreSQL and SQLite by design, so this is the first thing a new user meets, and as internal it read as a server fault.

This overturns a considered decision rather than filling a gap, so the old reasoning is recorded beside the new code and in docs/AGENT.md: the model failures were one label because "the user's next move is the same for all of them — look at the model settings". That held right up until the failure whose next move is to wait a minute.

Live verification

Agent mode on the SQLite sample — the first run in this programme to show an answer:

Closing statement — "### Department Average Salaries
                     1. Sales: ~79,643.10   2. Marketing: ~71,251.05
                     3. Finance: ~69,545.40  4. Development: ~61,466.30 …"
Run succeeded — "The model stopped without composing a cited report."

Agent mode on the LibreDB sample:

Run failed — "The agent cannot run on this database engine: it offers no read-only execution profile."

Six gates green, coverage 100% (33718/33718).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud