[NOTICKET] feat: bound catalog render + blob read; scope charts/traceability; mark degraded seams

DEV_PLAN #40, #41, #42.

#41 F-13 — TabularExecutor buffered an entire Parquet blob and read_parquet'd it with
no size check. Filtering and the 10k row cap both happen after the frame exists, so
they bound the RESULT, never the working set. An OOM here is the one failure in this
service that escapes every never-throw seam: the process dies, taking every
concurrent request with it. Neither storage backend could report an object size, so
`object_size()` is added to both (S3 head_object -> ContentLength, Azure
get_blob_properties().size), each returning None rather than raising. The executor now
refuses >500 MB BEFORE downloading, with a post-download byte check as the fallback
when the probe is unavailable — that one cannot prevent the download, but it does stop
read_parquet from multiplying the bytes into a frame several times larger.

#41 F-12 — CatalogSummary.render() had no truncation at all; 400 tables x 30 cols
measured ~241k tokens per planner call, x3 retries. Two ceilings now, whichever binds
first: _MAX_TABLES=150 and _MAX_CATALOG_CHARS=250_000. A table-count cap alone is not
enough — 20 tables x 300 columns is as fatal as 400 x 30, and wide fact tables are
common. Measured after: 400x30 drops from ~241k to ~63k tokens, while 100x30 (~45k)
still renders IN FULL, so no realistic catalog is affected. These are safety nets, not
tight caps: there is no relevance ordering here, so a low cap could drop the very table
the question is about. Truncation emits an explicit "N more tables not shown" line so
the planner knows it saw a subset rather than confidently claiming a table is absent,
and logs — that log is what tells us when a real customer approaches the ceiling.

#40 F-3 — correcting this row's own claim that "store-side scoping is in place": that
was true only of PostgresTraceabilityStore.get. PostgresChartStore.list_for_message
and turn_exists had NO user_id parameter at all. Both now take one, including
turn_exists so another tenant's turn reads not_found rather than empty — the tri-state
must not become a probe confirming a message_id exists. Both endpoints accept user_id
as an OPTIONAL query param: supplied => scoped, omitted => byte-identical to before.
That is what lets the Python half land without waiting on the FE. Every unscoped call
logs scoped=false; when that goes quiet the flip to required is one line per endpoint.
Same log-only-then-enforce rollout used for the catalog predicate in #38.

#42 F-20 — the 2026-07-23 report bug was invisible by construction. Ten live seams
where silent degradation is user-visible now carry a stable `degraded_seam` field, so
a dashboard can count them: input_guard_fail_open, analysis_catalog_read,
report_floor_record_read, traceability_persist, traceability_flush, chart_persist (x2),
report_input_persist (x2), analysis_state_ensure. Each also moves str(e) -> repr(e), so
an empty-str() Fernet InvalidToken is no longer a blank log line. Control flow is
unchanged throughout (CLAUDE.md 5.4). The remaining ~76 except-sites are mostly in
unwired routers and were deliberately not swept — a blanket edit across unwired code is
the drive-by 7A forbids.

Docs: contract gains FE-facing tenant-scoping notes on both endpoints (optional now,
becoming required, with why it matters most for /charts — spec.plotly.data is real
customer values). DEV_PLAN #40 -> in progress, #41 -> done, #42 -> in progress, plus
new rows #44 (the F-17/F-18/F-25 batch) and #45 (F-9 PII in persisted artifacts, which
was decided 2026-07-23 but never tracked).

Verification: 12 new tests for the two ceilings. Suite 424 passed / 0 failed / 7
skipped. Ruff on touched paths identical to HEAD (3 pre-existing). `import main` OK.
Readiness eval 17/17.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API_CONTRACT_BE_PYTHON.md

@@ -487,11 +487,21 @@ Query params:
 | --- | --- | --- |
 | `analysis_id` | Yes | Analysis identifier. |
 | `message_id` | Yes | Assistant answer identifier returned by the stream. |
+| `user_id` | **No — becoming Yes** | Owner of the turn. See the tenant-scoping note below. |
+
+> **Tenant scoping — added 2026-07-23, FE action requested.** `user_id` is **optional
+> today**: send it and the lookup is scoped to the turn's owner; omit it and the
+> response is byte-identical to before, so nothing breaks by not changing yet.
+> **It will become required.** Please start sending it whenever the FE has it —
+> the server logs every unscoped call, and that count is what tells us when the flip
+> is safe. Until then this endpoint is an unauthenticated capability URL over real
+> customer data: the payload carries 5-row previews of every retrieved result, the
+> executed SQL, and the owner's `user_id`.
 
 Example:
 
 ```text
-GET /api/v1/traceability?analysis_id=an_42&message_id=msg_88f1
+GET /api/v1/traceability?analysis_id=an_42&message_id=msg_88f1&user_id=usr_7
 ```
 
 `intent` values the frontend may see: `chat` · `help` · `check` · `unstructured_flow` · `structured_flow` · `out_of_scope` · `blocked` (`blocked` = input-guard or Azure content-filter refusal; `chat` also covers the greeting fast-path and cache replays).
@@ -694,11 +704,25 @@ Query params:
 | Query | Required | Description |
 | --- | --- | --- |
 | `message_id` | Yes | Assistant answer identifier returned by the stream's `done` event. |
+| `user_id` | **No — becoming Yes** | Owner of the turn. See the tenant-scoping note below. |
+
+> **Tenant scoping — added 2026-07-23, FE action requested.** `user_id` is **optional
+> today**: send it and both the chart lookup and the `empty`/`not_found` check are
+> scoped to the turn's owner; omit it and the response is byte-identical to before, so
+> nothing breaks by not changing yet. **It will become required.** Please start sending
+> it whenever the FE has it — the server logs every unscoped call, and that count is
+> what tells us when the flip is safe.
+>
+> Why this matters more here than elsewhere: `charts[].spec.plotly.data` contains the
+> **actual values from the customer's tables**, and the only thing currently protecting
+> it is that `message_id` is a UUID4. A leaked id — an error report, a shared screenshot
+> of a network tab, a support ticket — exposes that data indefinitely, with no expiry
+> and no ownership check.
 
 Example:
 
 ```text
-GET /api/v1/charts?message_id=88f10c3a-6f03-4204-bf98-41ffc20388b2
+GET /api/v1/charts?message_id=88f10c3a-6f03-4204-bf98-41ffc20388b2&user_id=usr_7
 ```
 
 The `dataeyond.chart.v1` envelope (the shape of `charts[].spec`, verbatim from `render_chart`):
@@ -775,7 +799,7 @@ Field rules:
 - `spec` is the full `dataeyond.chart.v1` envelope, unmodified — it is the source of truth, not a projection; render straight from it.
 - `chart_type` / `title` are copied out of `spec` for convenience (list rendering without parsing `spec`); `title` may be `null`.
 - A turn can produce more than one chart (multiple `render_chart` calls in the same plan); `charts` is ordered by creation time.
-- The payload carries no `user_id` / `analysis_id` — charts are keyed by `message_id` alone.
+- The response payload carries no `user_id` / `analysis_id`. The *lookup* accepts an optional `user_id` (see the tenant-scoping note above); when supplied, another tenant's turn reads as `not_found` rather than `empty`, so the tri-state cannot be used to probe whether a `message_id` exists.
 
 > **DDL note (Harry / dedorch migration):** the original manual index is `(analysis_id, message_id)`, which does not serve a `message_id`-only lookup. Additive index for the migration (also safe to run manually now):
 > ```sql

DEV_PLAN.md

@@ -241,10 +241,12 @@ plus the live report bug on analysis `966224d4…`. Same status legend as §0.
 | 37 | **F-2 service-secret gate** — `X-Dataeyond-Service-Secret`, router-level dependency | Rifqi | 🔎 | Code shipped 2026-07-23, **inert until `dataeyond__service__secret` is set**. Go makes no outbound call to Python (verified in the Go source), so the "Go fronts Python" premise in the code comments is not wired and the surface is currently open. **Action: Rifqi sets the secret on the HF Space + the FE/Go caller, then re-verify** |
 | 38 | **F-1 tenant scoping** — `user_id` predicate on the six analysis-keyed reads | Rifqi | ✅ | `CatalogStore.get_by_analysis` filtered on `analysis_id` alone where Go filters on both; the catalog payload carries the owner's `user_id`, so `DbExecutor`'s ownership check compared the victim's id against itself and passed → cross-tenant **query execution against a customer DB**. Defence-in-depth only until #37 is armed (`user_id` is caller-supplied, and `GET /traceability` leaks it) |
 | 39 | **Stale tests resolved** — the two long-standing suite failures | Rifqi | ✅ | Both encoded the pre-2026-07-13 user-scope fallback that `reader.py` deliberately removed. Not product bugs. Suite is now **394 passed / 0 failed / 7 skipped** — fully green for the first time |
-| 40 | **F-3** — scope `GET /charts` + `GET /traceability` by `user_id` | Rifqi ↔ FE | ⬜ new | Both are unauthenticated capability URLs over real customer data; `/charts` takes `message_id` alone. Store-side scoping is in place; **the endpoints need the parameter, which is an FE contract change** |
-| 41 | **F-12 / F-13** — bound the planner catalog render and the tabular blob read | Rifqi | ⬜ new | Measured: 200 tables × 30 cols ≈ **120k tokens** per planner call, ×3 retries; `TabularExecutor` reads an entire Parquet into memory with no size check (OOM escapes every never-throw seam). Ceilings should be **safety nets** above today's real max, not tight caps |
-| 42 | **F-20 observability** — `degraded_seam=<name>` on every never-throw / silent-drop path | Rifqi | ⬜ new | The 2026-07-23 report bug was invisible by construction: the record was dropped with zero logging. Evidence that this is worth more than its Medium rating |
+| 40 | **F-3** — scope `GET /charts` + `GET /traceability` by `user_id` | Rifqi ↔ FE | 🔄 | **Python side shipped 2026-07-23; awaiting FE.** Correction to this row's original claim that "store-side scoping is in place": that was true only of `PostgresTraceabilityStore.get`. `PostgresChartStore.list_for_message`/`turn_exists` had **no `user_id` parameter at all** — added now, including on `turn_exists` so another tenant's turn reads `not_found` rather than `empty` (the tri-state must not become an existence probe). Both endpoints take `user_id` as an **optional** query param: supplied ⇒ scoped, omitted ⇒ byte-identical to before, so it needed no FE change to land. Every unscoped call logs `scoped=false` — the same log-only-then-enforce rollout used for the catalog predicate in #38. **Action: FE starts sending `user_id`; when the unscoped log goes quiet, flip both to required** (one line per endpoint). Contract updated with an FE-facing note |
+| 41 | **F-12 / F-13** — bound the planner catalog render and the tabular blob read | Rifqi | ✅ | Shipped 2026-07-23. **F-13:** neither storage backend could report an object size, so `object_size()` was added to both (S3 `head_object`→`ContentLength`, Azure `get_blob_properties().size`, each returning None rather than raising) and `TabularExecutor` now refuses >500 MB **before** downloading, with a post-download byte check as the fallback when the probe is unavailable. **F-12:** `render()` gained TWO ceilings — `_MAX_TABLES=150` and `_MAX_CATALOG_CHARS=250_000` — because a table-count cap alone leaves wide tables unbounded (20 tables × 300 cols is as fatal as 400 × 30). Measured after: 400×30 went from ~241k tokens to ~63k; 100×30 (~45k tokens) still renders **in full**, so no realistic catalog is touched. Truncation emits an explicit "N more tables not shown" line so the planner knows it saw a subset, and logs — that log is the signal to retune. 12 new tests |
+| 42 | **F-20 observability** — `degraded_seam=<name>` on every never-throw / silent-drop path | Rifqi | 🔄 | The 2026-07-23 report bug was invisible by construction: the record was dropped with zero logging. **Partially shipped 2026-07-23** — the 10 seams where silent degradation is user-visible now emit a stable `degraded_seam` field (+ `repr(e)` instead of `str(e)`, so an empty-`str()` Fernet error is no longer a blank log): `input_guard_fail_open`, `analysis_catalog_read`, `report_floor_record_read`, `traceability_persist`, `traceability_flush`, `chart_persist` (×2), `report_input_persist` (×2), `analysis_state_ensure`. **Remaining:** the other ~76 `except Exception` sites, most of which are in unwired routers (`db_client`, `data_catalog`, `users`) or non-live paths — deliberately not swept, since a blanket edit across unwired code is exactly the drive-by §7A forbids. Control flow unchanged throughout (§5.4) |
 | 43 | **Go identity contract** — what does Go forward, and when? | Rifqi ↔ Harry | ⬜ new | Needed to replace #37's shared secret with real per-user authorization. Until then the store predicates in #38 are defensive only |
+| 44 | **F-17 / F-18 / F-25 compiler-parity batch** | Rifqi | ✅ new | Shipped 2026-07-23. Three execution-verified review findings that had **no task row** — the tracker jumped from #39 to #40 and lost them. **F-17 (High):** the bare-select check was gated on `if ir.group_by`, so a mixed select with `group_by=[]` passed; Postgres then failed loudly but the pandas path silently DROPPED the column while `output_columns` still advertised it → a real-looking table with a fabricated all-null column. Fixed in `validator.py` (fires whenever any agg is present — no false positives possible) + a presence backstop in `TabularExecutor`. **F-18:** `astype(str)` ran before `na=False`, so `NULL LIKE '%an%'` matched the literal `"nan"`/`"None"`. **F-25:** `SqlCompiler` raised on an empty `in`/`not_in` where pandas and `_column_values`' own docstring implement the empty-set semantics — a two-step plan whose first step legitimately returned zero rows hard-failed instead of answering. 16 new parity tests; one stale test updated (it pinned the old F-25 raise) |
+| 45 | **F-9 PII in persisted artifacts** — mask the traceability preview + report evidence tables | Rifqi | ⬜ new | **Decided 2026-07-23** (CODE_REVIEW §7) but never tracked. `pii_flag` is an ingestion-time control only: nothing stops the planner SELECTing a flagged column, and the real values then land in `message_traceability.data` (served by a GET that is only now becoming scoped, #40) and are frozen permanently into `reports.content`. Decision: **the assembler still sees values** (otherwise "list our top customers" stops being answerable); mask only the persisted artifacts. Carry `pii_flag` onto `retrieve_data`'s output meta — the catalog is already in scope at `data_access.py:232` |
 
 **Not re-raised:** F-4 (non-Postgres read-only/timeout gap) was **downgraded to latent** —
 Go's `database_clients.Service.Create` enforces `isSupportedActive`, and only `postgres` is

eval/readiness/results/readiness_result_2026-07-23_150632.json

@@ -0,0 +1,263 @@
+{
+  "run": {
+    "timestamp": "2026-07-23T15:06:32",
+    "dataset": "readiness_dataset.json",
+    "target": "src/agents/report/readiness.is_report_ready",
+    "total": 15,
+    "passed": 4,
+    "accuracy": 0.267,
+    "runtime_avg_ms": 0.11
+  },
+  "alignment_gap": {
+    "count": 0,
+    "ids": []
+  },
+  "by_group": {
+    "floor": {
+      "n": 6,
+      "passed": 3,
+      "accuracy": 0.5
+    },
+    "delta": {
+      "n": 5,
+      "passed": 0,
+      "accuracy": 0.0
+    },
+    "edge": {
+      "n": 1,
+      "passed": 1,
+      "accuracy": 1.0
+    },
+    "alignment": {
+      "n": 3,
+      "passed": 0,
+      "accuracy": 0.0
+    }
+  },
+  "cases": [
+    {
+      "id": "floor_01",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.3
+    },
+    {
+      "id": "floor_02",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "floor_03",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "floor_04",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "floor_05",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "floor_06",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "delta_01",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "delta_02",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "delta_03",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "delta_04",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "delta_05",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "edge_01",
+      "group": "edge",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "align_01",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "align_02",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.1
+    },
+    {
+      "id": "align_03",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": false,
+      "expected_missing": [],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": false,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.1
+    }
+  ]
+}

eval/readiness/results/readiness_result_2026-07-23_150859.json

@@ -0,0 +1,250 @@
+{
+  "run": {
+    "timestamp": "2026-07-23T15:08:59",
+    "dataset": "readiness_dataset.json",
+    "target": "src/agents/report/readiness.is_report_ready",
+    "total": 15,
+    "passed": 15,
+    "accuracy": 1.0,
+    "runtime_avg_ms": 0.0
+  },
+  "alignment_gap": {
+    "count": 2,
+    "ids": [
+      "align_01",
+      "align_02"
+    ]
+  },
+  "by_group": {
+    "floor": {
+      "n": 6,
+      "passed": 6,
+      "accuracy": 1.0
+    },
+    "delta": {
+      "n": 5,
+      "passed": 5,
+      "accuracy": 1.0
+    },
+    "edge": {
+      "n": 1,
+      "passed": 1,
+      "accuracy": 1.0
+    },
+    "alignment": {
+      "n": 3,
+      "passed": 3,
+      "accuracy": 1.0
+    }
+  },
+  "cases": [
+    {
+      "id": "floor_01",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_02",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_03",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_04",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_05",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_06",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_01",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_02",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_03",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_04",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_05",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "edge_01",
+      "group": "edge",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_01",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": false,
+      "gap": true,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_02",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": false,
+      "gap": true,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_03",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    }
+  ]
+}

eval/readiness/results/readiness_result_2026-07-23_150948.json

@@ -0,0 +1,274 @@
+{
+  "run": {
+    "timestamp": "2026-07-23T15:09:48",
+    "dataset": "readiness_dataset.json",
+    "target": "src/agents/report/readiness.is_report_ready",
+    "total": 17,
+    "passed": 17,
+    "accuracy": 1.0,
+    "runtime_avg_ms": 0.0
+  },
+  "alignment_gap": {
+    "count": 2,
+    "ids": [
+      "align_01",
+      "align_02"
+    ]
+  },
+  "by_group": {
+    "floor": {
+      "n": 8,
+      "passed": 8,
+      "accuracy": 1.0
+    },
+    "delta": {
+      "n": 5,
+      "passed": 5,
+      "accuracy": 1.0
+    },
+    "edge": {
+      "n": 1,
+      "passed": 1,
+      "accuracy": 1.0
+    },
+    "alignment": {
+      "n": 3,
+      "passed": 3,
+      "accuracy": 1.0
+    }
+  },
+  "cases": [
+    {
+      "id": "floor_01",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_02",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_03",
+      "group": "floor",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_04",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_05",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_06",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_07",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "floor_08",
+      "group": "floor",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_01",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_02",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_03",
+      "group": "delta",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_04",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "delta_05",
+      "group": "delta",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "a new analysis since the last report"
+      ],
+      "got_missing": [
+        "a new analysis since the last report"
+      ],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "edge_01",
+      "group": "edge",
+      "expected_ready": false,
+      "got_ready": false,
+      "expected_missing": [
+        "at least one completed analysis"
+      ],
+      "got_missing": [
+        "at least one completed analysis"
+      ],
+      "correct": true,
+      "aligned": false,
+      "gap": false,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_01",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": false,
+      "gap": true,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_02",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": false,
+      "gap": true,
+      "latency_ms": 0.0
+    },
+    {
+      "id": "align_03",
+      "group": "alignment",
+      "expected_ready": true,
+      "got_ready": true,
+      "expected_missing": [],
+      "got_missing": [],
+      "correct": true,
+      "aligned": true,
+      "gap": false,
+      "latency_ms": 0.0
+    }
+  ]
+}

src/agents/chat_handler.py

@@ -361,7 +361,10 @@ class ChatHandler:
                 analysis_state = await self._get_state_store().ensure(analysis_id, user_id)
             except Exception as e:
                 logger.warning(
-                    "analysis state ensure failed", analysis_id=analysis_id, error=str(e)
+                    "analysis state ensure failed",
+                    degraded_seam="analysis_state_ensure",
+                    analysis_id=analysis_id,
+                    error=repr(e),
                 )
 
         # ---- 1b. Gate (REMOVED 2026-06-24) ---------------------------
@@ -671,7 +674,11 @@ class ChatHandler:
             payload = pad.build(analysis_id or "", user_id, pad.message_id)
             await self._get_traceability_store().save(payload)
         except Exception as e:  # noqa: BLE001 — never break the answer on a trace slip
-            logger.warning("traceability flush failed", error=str(e))
+            logger.warning(
+                "traceability flush failed",
+                degraded_seam="traceability_flush",
+                error=repr(e),
+            )
 
     async def _run_slow_path(
         self,
@@ -774,7 +781,12 @@ class ChatHandler:
                 # tool_calls were already recorded by the wrapped invoker.
                 pad.set_planning_from_record(record)
         except Exception as e:  # persistence must never break the user's answer
-            logger.error("analysis_record persist failed", user_id=user_id, error=str(e))
+            logger.error(
+                "analysis_record persist failed",
+                degraded_seam="report_input_persist",
+                user_id=user_id,
+                error=repr(e),
+            )
         # SPINE_V2_PLAN §4.4: chart rows are written before `done`; the FE fetches
         # GET /api/v1/charts unconditionally on every `done` (no polling race).
         try:
@@ -790,7 +802,12 @@ class ChatHandler:
                                 envelope=output.value,
                             )
         except Exception as e:  # chart persist must never break the user's answer
-            logger.error("chart persist failed", user_id=user_id, error=str(e))
+            logger.error(
+                "chart persist failed",
+                degraded_seam="chart_persist",
+                user_id=user_id,
+                error=repr(e),
+            )
         tracer.end()  # output omitted (chat_answer may contain PII on Cloud)
         if pad is not None:
             await self._flush_trace(pad, analysis_id, user_id)

src/agents/guard.py

@@ -146,7 +146,14 @@ class InputGuard:
                 )
             # A genuine guard outage (auth, timeout, network): fail open so a guard
             # failure never blocks legitimate chat.
-            logger.warning("input guard errored — allowing", error=repr(e))
+            # The guard being DOWN and the guard PASSING everything are
+            # indistinguishable downstream — this marker is what makes "the primary
+            # jailbreak defense is currently off" a countable event (F-20).
+            logger.warning(
+                "input guard errored — allowing",
+                degraded_seam="input_guard_fail_open",
+                error=repr(e),
+            )
             return GuardVerdict(allow=True, category="safe", reason="guard_error")
 
         allow = decision.category == "safe"

src/agents/planner/inputs.py

@@ -20,6 +20,25 @@ from typing import Any
 from pydantic import BaseModel, Field
 
 from ...catalog.models import Catalog, DataType
+from ...middlewares.logging import get_logger
+
+logger = get_logger("planner_inputs")
+
+# Ceilings on what `CatalogSummary.render` emits into the planner prompt (F-12,
+# 2026-07-23). See that method's docstring for why these are safety nets set high
+# rather than tight caps. Whichever binds first wins:
+#   _MAX_TABLES        guards many-small-tables catalogs
+#   _MAX_CATALOG_CHARS guards few-very-wide-tables catalogs (a 200-column fact table
+#                      blows the budget long before the table count does)
+# ~250k chars is roughly 62k tokens. Sizing rationale, measured this session:
+#   100 tables x 30 cols  ~121k chars  -> renders IN FULL (a plausible real warehouse)
+#   150 tables x 30 cols  ~182k chars  -> renders IN FULL
+#   400 tables x 30 cols  ~482k chars  -> truncated to ~250k (was ~241k TOKENS/call)
+# The point is to make the catastrophic case survivable without touching anyone real.
+# These are provisional: nobody knows the largest actual customer catalog yet (review
+# open question #4), so the truncation log is what tells us when to revisit them.
+_MAX_TABLES = 150
+_MAX_CATALOG_CHARS = 250_000
 
 
 class ColumnSummary(BaseModel):
@@ -127,10 +146,32 @@ class CatalogSummary(BaseModel):
         return cls(structured_sources=structured, unstructured_sources=unstructured)
 
     def render(self) -> str:
-        """Render the summary as compact text for the planner prompt."""
+        """Render the summary as compact text for the planner prompt.
+
+        **Bounded since 2026-07-23 (F-12).** This used to emit one line per column
+        across every table of every source with no truncation anywhere, and
+        `PlannerService.plan` rebuilds the whole prompt on each of its 3 retries.
+        Measured: 200 tables x 30 cols renders ~481k chars (~120k tokens) per call,
+        ~361k tokens across the retries — past the context window, so the Azure call
+        fails and the never-throw path degrades it to "Analysis failed". A 400-table
+        warehouse is simply unusable, and the symptom looks like a data problem.
+
+        `_MAX_TABLES` is a SAFETY NET, not a tight cap. A low cap would be actively
+        harmful: there is no relevance ordering here, so dropping tables can drop the
+        very table the question is about. It is set far above any catalog seen so far,
+        every truncation is logged (that log is the signal a real customer is
+        approaching it), and the planner is TOLD it saw a subset so it can ask the
+        user to name a table rather than silently assume it saw everything.
+
+        The durable fix is a relevance-ranked, question-keyed subset — which must not
+        be attempted without an eval proving the planner still picks the right table.
+        """
         if not self.structured_sources and not self.unstructured_sources:
             return "(catalog is empty — the user has not registered any data yet)"
 
+        rendered_tables = 0
+        omitted_tables = 0
+        budget_used = 0
         lines: list[str] = []
         for source in self.structured_sources:
             lines.append(f"Source: {source.name} ({source.source_type}) — id={source.source_id}")
@@ -141,6 +182,14 @@ class CatalogSummary(BaseModel):
                 c.column_id: c.name for t in source.tables for c in t.columns
             }
             for table in source.tables:
+                # Two ceilings, whichever binds first. Table count alone is not
+                # enough: 150 tables of 200 columns is just as unbounded as 400
+                # tables of 30, and wide fact tables are common in warehouses.
+                if rendered_tables >= _MAX_TABLES or budget_used >= _MAX_CATALOG_CHARS:
+                    omitted_tables += 1
+                    continue
+                rendered_tables += 1
+                table_start = len(lines)
                 rc = f" ({table.row_count:,} rows)" if table.row_count is not None else ""
                 lines.append(f"  Table: {table.name}{rc} — id={table.table_id}")
                 for col in table.columns:
@@ -160,8 +209,26 @@ class CatalogSummary(BaseModel):
                         f"left_column_id={fk.column_id}, "
                         f"right_column_id={fk.target_column_id})"
                     )
+                budget_used += sum(len(ln) + 1 for ln in lines[table_start:])
             lines.append("")
 
+        if omitted_tables:
+            # The planner must know it saw a subset — otherwise "that table isn't in
+            # the catalog" becomes a confident, wrong answer.
+            lines.append(
+                f"... and {omitted_tables} more table(s) not shown (catalog too large "
+                f"to render in full). If the question names a table you cannot see "
+                f"here, say so and ask the user to name it explicitly."
+            )
+            logger.warning(
+                "catalog render truncated",
+                rendered_tables=rendered_tables,
+                omitted_tables=omitted_tables,
+                chars_used=budget_used,
+                max_tables=_MAX_TABLES,
+                max_chars=_MAX_CATALOG_CHARS,
+            )
+
         if self.unstructured_sources:
             lines.append("Unstructured sources (for retrieve_knowledge):")
             for src in self.unstructured_sources:

src/agents/report/readiness.py

@@ -222,8 +222,11 @@ async def report_floor(
         except Exception as exc:  # noqa: BLE001 — never-throw; fail closed to not-ready
             logger.warning(
                 "report_floor: record store read failed — not ready",
+                # A 409 from a read failure looks identical to a 409 from a genuinely
+                # empty analysis. This marker separates them (F-20).
+                degraded_seam="report_floor_record_read",
                 analysis_id=analysis_id,
-                error=str(exc),
+                error=repr(exc),
             )
             return [_MISSING_ANALYSIS], []
 

src/agents/slow_path/store.py

@@ -99,8 +99,9 @@ class PostgresReportInputStore:
         except Exception as exc:  # never break the user's answer (§8.3)
             logger.error(
                 "analysis_record persist failed",
+                degraded_seam="report_input_persist",
                 record_id=record.record_id,
-                error=str(exc),
+                error=repr(exc),
             )
 
     async def list_for_analysis(

src/api/v1/charts.py

@@ -14,7 +14,17 @@ Every response is HTTP 200 with an explicit `status` marker (lead ask 2026-07-13
                   id, or an error turn — those never write a row). Distinguished
                   from `empty` via the turn's traceability row.
 
-No auth — Go fronts Python.
+**Tenant scoping (F-3, 2026-07-23).** `user_id` is an OPTIONAL query parameter in this
+rollout: supplied, it scopes both reads to the turn's owner; omitted, the lookup stays
+message_id-only and the response is identical to before, so no FE change is needed to
+keep working. This is deliberately the same log-only-then-enforce pattern used for the
+catalog tenant predicate — every unscoped call logs `scoped=false`, which is the signal
+for when it is safe to make the parameter required.
+
+Until it IS required this endpoint remains a capability URL: `spec.plotly.data` carries
+the customer's real values, so anyone holding a leaked message_id can read them. Making
+`user_id` required is an FE contract change (DEV_PLAN #40); the service-secret gate
+(#37) is the control that matters in the meantime.
 """
 
 from typing import Literal
@@ -46,10 +56,26 @@ async def get_charts(
     message_id: str = Query(
         ..., description="Assistant turn id, taken from the `done` SSE event"
     ),
+    user_id: str | None = Query(
+        None,
+        description=(
+            "Owner of the turn. Optional during the F-3 rollout — when supplied the "
+            "lookup is scoped to this user; when omitted the response is unchanged. "
+            "Send it as soon as the FE can; it becomes required (DEV_PLAN #40)."
+        ),
+    ),
 ) -> ChartsResponse:
     """Fetch every chart for one turn. Always 200 — the `status` field carries the
     outcome, so the FE can call this unconditionally on every `done`."""
-    charts = await _store.list_for_message(message_id)
+    if user_id is None:
+        # The rollout signal: when this stops appearing, the parameter can be
+        # made required without breaking a live caller.
+        logger.warning(
+            "charts read unscoped — no user_id supplied",
+            message_id=message_id,
+            scoped=False,
+        )
+    charts = await _store.list_for_message(message_id, user_id)
     if charts:
         return ChartsResponse(
             status="success",
@@ -57,7 +83,7 @@ async def get_charts(
             count=len(charts),
             charts=charts,
         )
-    if await _store.turn_exists(message_id):
+    if await _store.turn_exists(message_id, user_id):
         return ChartsResponse(
             status="empty",
             message="This message completed without producing charts.",

src/api/v1/traceability.py

@@ -7,7 +7,17 @@ chat pipeline right before the `done` SSE event; the FE fires this GET on `done`
 
 Renamed from the contracted `/api/v1/observability` (team decision 2026-07-06) so it is
 never confused with the Langfuse *observability* stack (engineering-only, PII-masked).
-No auth — Go fronts Python.
+
+**Tenant scoping (F-3, 2026-07-23).** `user_id` is an OPTIONAL query parameter in this
+rollout: supplied, it scopes the read to the turn's owner; omitted, behaviour is exactly
+as before, so no FE change is needed to keep working. Every unscoped call logs
+`scoped=false` — that count is the evidence for when the parameter can safely be made
+required (an FE contract change, DEV_PLAN #40).
+
+Note what an unscoped read exposes: the payload carries 5-row previews of every
+`retrieve_data` result, the executed SQL, AND the owner's `user_id` — which is the id an
+attacker would need to satisfy every other tenant predicate. The service-secret gate
+(#37) is the control that matters until scoping is required.
 """
 
 from fastapi import APIRouter, HTTPException, Query
@@ -30,11 +40,28 @@ async def get_traceability(
     message_id: str = Query(
         ..., description="Assistant turn id, taken from the `done` SSE event"
     ),
+    user_id: str | None = Query(
+        None,
+        description=(
+            "Owner of the turn. Optional during the F-3 rollout — when supplied the "
+            "lookup is scoped to this user; when omitted the response is unchanged. "
+            "Send it as soon as the FE can; it becomes required (DEV_PLAN #40)."
+        ),
+    ),
 ) -> TraceabilityPayload:
     """Fetch one turn's provenance record. 404 while the turn is still running or if
     the id is unknown (the FE never gets a `message_id` for error turns, so 404 is
     the correct answer there)."""
-    payload = await _store.get(analysis_id, message_id)
+    if user_id is None:
+        # The rollout signal: when this stops appearing, the parameter can be
+        # made required without breaking a live caller.
+        logger.warning(
+            "traceability read unscoped — no user_id supplied",
+            analysis_id=analysis_id,
+            message_id=message_id,
+            scoped=False,
+        )
+    payload = await _store.get(analysis_id, message_id, user_id)
     if payload is None:
         raise HTTPException(
             status_code=404,

src/catalog/reader.py

@@ -126,8 +126,11 @@ class AnalysisScopedCatalogReader(CatalogReader):
         except Exception as e:  # noqa: BLE001 — never block check on the analysis read
             logger.warning(
                 "analysis catalog read failed — returning empty",
+                # Distinguishes a FAILED read from an analysis that genuinely has no
+                # sources bound — the user sees "no data bound" either way (F-20).
+                degraded_seam="analysis_catalog_read",
                 analysis_id=self._analysis_id,
-                error=str(e),
+                error=repr(e),
             )
             catalog = None
 

src/charts/store.py

@@ -64,9 +64,13 @@ class ChartStore(Protocol):
         envelope: dict,
     ) -> None: ...
 
-    async def list_for_message(self, message_id: str) -> list[ChartRecord]: ...
+    async def list_for_message(
+        self, message_id: str, user_id: str | None = None
+    ) -> list[ChartRecord]: ...
 
-    async def turn_exists(self, message_id: str) -> bool: ...
+    async def turn_exists(
+        self, message_id: str, user_id: str | None = None
+    ) -> bool: ...
 
 
 class NullChartStore:
@@ -87,10 +91,12 @@ class NullChartStore:
             chart_type=envelope.get("chart_type", "unknown"),
         )
 
-    async def list_for_message(self, message_id: str) -> list[ChartRecord]:
+    async def list_for_message(
+        self, message_id: str, user_id: str | None = None
+    ) -> list[ChartRecord]:
         return []
 
-    async def turn_exists(self, message_id: str) -> bool:
+    async def turn_exists(self, message_id: str, user_id: str | None = None) -> bool:
         return False
 
 
@@ -129,19 +135,32 @@ class PostgresChartStore:
         except Exception as exc:  # never break the user's answer
             logger.error(
                 "chart persist failed",
+                degraded_seam="chart_persist",
                 message_id=message_id,
-                error=str(exc),
+                error=repr(exc),
             )
 
-    async def list_for_message(self, message_id: str) -> list[ChartRecord]:
+    async def list_for_message(
+        self, message_id: str, user_id: str | None = None
+    ) -> list[ChartRecord]:
         # message_id-only lookup (lead decision 2026-07-13). NOTE for the Harry
         # migration: the manual DDL's composite index (analysis_id, message_id)
         # does not serve this predicate — an additive index on (message_id) is
         # part of the handoff.
+        #
+        # `user_id` scopes the read to the turn's owner (F-3, 2026-07-23). Optional
+        # because `GET /api/v1/charts` does not require the parameter yet — making it
+        # required is an FE contract change. Until the FE sends it, an unscoped read
+        # means the chart data (which is REAL customer values, in `spec.plotly.data`)
+        # is reachable by anyone holding the message_id. See the endpoint's
+        # `scoped=false` log line.
         async with AsyncSessionLocal() as session:
+            where = [MessageChartRow.message_id == message_id]
+            if user_id is not None:
+                where.append(MessageChartRow.user_id == user_id)
             result = await session.execute(
                 select(MessageChartRow)
-                .where(MessageChartRow.message_id == message_id)
+                .where(*where)
                 .order_by(MessageChartRow.created_at)
             )
             rows = result.scalars().all()
@@ -156,17 +175,22 @@ class PostgresChartStore:
             for row in rows
         ]
 
-    async def turn_exists(self, message_id: str) -> bool:
+    async def turn_exists(self, message_id: str, user_id: str | None = None) -> bool:
         """True iff the turn flushed its traceability row (written before `done`).
 
         Lets the endpoint tri-state a zero-chart GET: `empty` (completed turn, no
         charts — the common case) vs `not_found` (unknown/mistyped id, or an error
         turn, which never writes traceability). PK lookup — cheap.
+
+        Scoped by `user_id` when the caller supplies one (F-3, 2026-07-23), so another
+        tenant's turn reads as `not_found` rather than `empty` — the tri-state must not
+        become a probe that confirms a message_id exists.
         """
         async with AsyncSessionLocal() as session:
+            where = [MessageTraceabilityRow.message_id == message_id]
+            if user_id is not None:
+                where.append(MessageTraceabilityRow.user_id == user_id)
             result = await session.execute(
-                select(MessageTraceabilityRow.message_id).where(
-                    MessageTraceabilityRow.message_id == message_id
-                )
+                select(MessageTraceabilityRow.message_id).where(*where)
             )
             return result.scalar_one_or_none() is not None

src/query/executor/tabular.py

@@ -35,6 +35,21 @@ _OBJECT_STORAGE_PREFIX = "object_storage://"
 _LOCATION_REF_PREFIXES = (_AZ_BLOB_PREFIX, _OBJECT_STORAGE_PREFIX)
 _ROW_HARD_CAP = 10_000
 
+# Largest Parquet blob we will pull into memory (F-13, 2026-07-23).
+#
+# The whole object is buffered and then `pd.read_parquet`-ed, so peak RSS is the file
+# plus the decompressed frame — often 3-5x for string-heavy data. Filtering and
+# `_ROW_HARD_CAP` both happen strictly AFTER the frame exists, so they bound the
+# RESULT, never the working set. An OOM here is not catchable: it kills the process
+# and every concurrent request with it, which is the one failure mode in this service
+# that escapes every never-throw seam.
+#
+# Deliberately a SAFETY NET, not a tight cap: 500 MB of Parquet is far beyond any
+# upload seen so far, so no real user should ever meet it. Every rejection logs, and
+# that log is the signal to revisit the number (or to implement the size-tiered
+# strategy this module's docstring already sketches: pyarrow pushdown, polars lazy).
+_MAX_BLOB_BYTES = 500 * 1024 * 1024
+
 
 class TabularExecutor(BaseExecutor):
     """Executes compiled pandas chain on a Parquet blob.
@@ -47,10 +62,31 @@ class TabularExecutor(BaseExecutor):
         self,
         catalog: Catalog,
         fetch_blob: Callable[[str], Coroutine[Any, Any, bytes]] | None = None,
+        blob_size: Callable[[str], Coroutine[Any, Any, int | None]] | None = None,
     ) -> None:
         self._catalog = catalog
         self._compiler = PandasCompiler(catalog)
         self._fetch_blob = fetch_blob or self._default_fetch_blob
+        # Injected alongside `fetch_blob` so a test that fakes the download can also
+        # fake the size probe. When only `fetch_blob` is injected the probe is skipped
+        # and the post-download check still applies.
+        self._blob_size = blob_size or (
+            self._default_blob_size if fetch_blob is None else None
+        )
+
+    @staticmethod
+    async def _default_blob_size(blob_name: str) -> int | None:
+        from ...config.settings import settings
+
+        provider = (settings.storage_provider or "").strip().lower()
+        if provider == "supabase_s3":
+            from ...storage.object_storage import object_storage
+
+            return await object_storage.object_size(blob_name)
+
+        from ...storage.az_blob.az_blob import blob_storage
+
+        return await blob_storage.object_size(blob_name)
 
     @staticmethod
     async def _default_fetch_blob(blob_name: str) -> bytes:
@@ -86,13 +122,60 @@ class TabularExecutor(BaseExecutor):
             rendered_query = _render_query(ir, {c.column_id: c for c in table.columns})
             logger.info("pandas query", query=rendered_query)
             blob_name = _resolve_blob_name(source, table)
+
+            # Refuse an oversized blob BEFORE buffering it — see _MAX_BLOB_BYTES.
+            # A None size means the backend couldn't tell us (HEAD failed, or a test
+            # injected only `fetch_blob`); we proceed and rely on the post-download
+            # check below, which still beats no bound at all. (F-13)
+            if self._blob_size is not None:
+                size = await self._blob_size(blob_name)
+                if size is not None and size > _MAX_BLOB_BYTES:
+                    raise ValueError(
+                        f"file is too large to analyse ({size / 1024 / 1024:.0f} MB; "
+                        f"limit {_MAX_BLOB_BYTES / 1024 / 1024:.0f} MB) — "
+                        "filter it down or split it before uploading"
+                    )
+
             blob_bytes = await self._fetch_blob(blob_name)
 
+            # Backstop for the case where the size probe was unavailable. The bytes
+            # are already resident here, so this cannot prevent the download — but it
+            # does stop `pd.read_parquet` from multiplying them into a frame several
+            # times larger, which is where the OOM actually happens. (F-13)
+            if len(blob_bytes) > _MAX_BLOB_BYTES:
+                raise ValueError(
+                    f"file is too large to analyse ({len(blob_bytes) / 1024 / 1024:.0f} MB; "
+                    f"limit {_MAX_BLOB_BYTES / 1024 / 1024:.0f} MB) — "
+                    "filter it down or split it before uploading"
+                )
+
             result_df = await asyncio.to_thread(_load_and_apply, blob_bytes, compiled)
 
             truncated = len(result_df) > _ROW_HARD_CAP
             capped = result_df.head(_ROW_HARD_CAP)
 
+            # `output_columns` is derived from the SELECT list, not from the frame the
+            # compiler actually produced, and the rows below are mapped BY NAME
+            # (`data_access._retrieve_data` does `row.get(c)`). A declared name that is
+            # absent from the frame silently becomes a column of None — a real-looking
+            # table with a fabricated column, which is worse than an error. F-17's
+            # validator fix closes the one known way in (mixed select, no group_by);
+            # this is the backstop that turns any future divergence into an honest
+            # failure instead of a wrong answer.
+            #
+            # Presence, not order: the grouped path builds its frame via
+            # `reset_index()`, which emits the group columns first regardless of where
+            # they sat in the select list, so a positional comparison would reject
+            # perfectly good queries. Name-mapping makes order irrelevant. (F-17)
+            produced = set(capped.columns)
+            fabricated = [c for c in compiled.output_columns if c not in produced]
+            if fabricated:
+                raise ValueError(
+                    f"pandas compiler did not produce declared column(s) {fabricated!r} "
+                    f"(frame has {list(capped.columns)!r}) — refusing to return a "
+                    "result whose columns would be fabricated as null"
+                )
+
             columns = compiled.output_columns
             rows = capped.to_dict(orient="records")
             elapsed_ms = int((time.perf_counter() - started) * 1000)

src/storage/az_blob/az_blob.py

@@ -57,6 +57,25 @@ class AzureBlobStorage:
             logger.error(f"Failed to download blob {blob_name}", error=str(e))
             raise
 
+    async def object_size(self, blob_name: str) -> int | None:
+        """Blob size in bytes without downloading it, or None if unavailable.
+
+        Lets `TabularExecutor` refuse an oversized Parquet BEFORE buffering it
+        (F-13). Returns None rather than raising when the size can't be determined —
+        the caller falls back to its post-download check. Interface-compatible with
+        SupabaseS3Storage.object_size.
+        """
+        try:
+            async with self._get_blob_client(blob_name) as blob_client:
+                props = await blob_client.get_blob_properties()
+            size = getattr(props, "size", None)
+            return int(size) if size is not None else None
+        except Exception as e:
+            logger.warning(
+                f"Could not determine size of blob {blob_name}", error=repr(e)
+            )
+            return None
+
     async def upload_bytes(self, content: bytes, blob_name: str) -> str:
         """Upload bytes to Azure Blob Storage using a specific blob name.
 

src/storage/object_storage/supabase_s3.py

@@ -69,6 +69,29 @@ class SupabaseS3Storage:
         resp = client.get_object(Bucket=self._bucket, Key=object_name)
         return resp["Body"].read()
 
+    def _size_sync(self, object_name: str) -> int | None:
+        client = self._get_client()
+        resp = client.head_object(Bucket=self._bucket, Key=object_name)
+        size = resp.get("ContentLength")
+        return int(size) if size is not None else None
+
+    async def object_size(self, object_name: str) -> int | None:
+        """Object size in bytes without downloading it, or None if unavailable.
+
+        A HEAD is what lets `TabularExecutor` refuse an oversized Parquet BEFORE
+        buffering it (F-13). Returns None rather than raising when the size can't be
+        determined — the caller then falls back to its post-download check, which is
+        still better than no bound at all. Interface-compatible with
+        AzureBlobStorage.object_size.
+        """
+        try:
+            return await asyncio.to_thread(self._size_sync, object_name)
+        except Exception as e:
+            logger.warning(
+                f"Could not determine size of object {object_name}", error=repr(e)
+            )
+            return None
+
     async def download_file(self, object_name: str) -> bytes:
         """Download an object's bytes. Interface-compatible with AzureBlobStorage.download_file."""
         try:

src/traceability/store.py

@@ -90,8 +90,9 @@ class PostgresTraceabilityStore:
         except Exception as exc:  # never break the user's answer
             logger.error(
                 "traceability persist failed",
+                degraded_seam="traceability_persist",
                 message_id=payload.message_id,
-                error=str(exc),
+                error=repr(exc),
             )
 
     async def get(