fix(v2-api): close a third secret disclosure and make concealment coherent

**Secret disclosure — run snapshot.** `GET /api/v2/logs/{runId}` returned
`workflowState` straight from `workflowExecutionSnapshots.stateData`, which is
the workflow graph: `blocks[].subBlocks[].value` holds `password: true` field
values and `oauth-input` credential ids. Nothing on that path sanitized it, and
the field was typed `z.unknown()`, so the builder's response parse stripped
nothing. A read-role workspace API key could read plaintext credentials.

This is the third instance of one pattern, and the pattern is the finding: the
builder protects every response by re-parsing it, so the only fields that can
leak are the ones typed `z.unknown()` or `z.custom()`. Both prior disclosures
sat behind exactly such a field. The snapshot is now sanitized in the use case
and the field is typed object-or-null. An inventory of every remaining
`z.unknown()` in the v2 contracts is in the PR description; two carry data with
no projection behind them and are named there as follow-ups.

**Concealment was bypassable.** `createV2ResourceConcealmentPolicy` rewrites
resource-authorization failures to 404 so a caller cannot probe for existence.
Workflows and files applied it on every verb; tables and knowledge applied it
only on reads. A caller could therefore probe with PATCH, read the 403, and
learn the resource exists — the read-side concealment bought nothing. Nine
mutation sites now conceal, plus the three table-column verbs, which were
inconsistent with their own sibling sub-resources.

`lib/logs/api/route-policies.ts` was a second, divergent implementation that
sniffed `response.status === 403` and so also swallowed workspace-policy
denials the canonical helper deliberately preserves. It now uses the helper. A
third such sniff survives in the upload-control helper and is noted as a
follow-up.

Also:
- `DELETE /tables/{tableId}/rows/{rowId}` returned the bulk `{deletedCount,
  deletedRowIds}` shape while nine sibling single-resource deletes return
  `{id, deleted}`. It now matches them.
- Nine operations can 404 on an unknown folder path and did not document it;
  `createWorkflow` could 413 on an oversized folder tree and did not; getting a
  run can 409 when trace data was truncated and did not.
- `queryTableRows` documented a 413 it cannot emit and `resumeWorkflowRun` a
  423 with no lock guard anywhere in its path — the same un-producible-status
  class already cleared for 410 elsewhere.
- Execute's 409 description covered only the run-id case after the
  recursion-guard fix added a second cause, and named a code the route does not
  emit: the wire carries `error.code: CONFLICT` with the specific cause in
  `error.details.code`. `x-sim-via` is now a declared request header.
- Deploy and rollback published examples that were impossible: `isDeployed:
  true` beside `activeDeployment: null`, where the route computes the former
  from the latter.
- `afterRowId`/`beforeRowId` were published on row insert and silently dropped
  by the route, so a positional insert became a tail append.
- A generated document whose script fails permanently answered "still being
  generated, try again" forever; the underlying cause is now preserved.

Author: waleedlatif1

apps/docs/openapi-v2-billing.json

@@ -364,7 +364,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"

apps/docs/openapi-v2-files-audit.json

@@ -154,6 +154,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           },
@@ -281,6 +284,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           },
@@ -1981,7 +1987,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"
@@ -2134,12 +2140,12 @@
           "size": {
             "type": "number",
             "minimum": 0,
-            "description": "File size in bytes.",
+            "description": "Size in bytes of the stored file. For a generated document (docx, pptx, pdf, xlsx) the stored file is the generation source rather than the rendered document, so this does not predict how many bytes `GET /files/{fileId}` returns — that endpoint serves the compiled artifact, which is typically much larger.",
             "examples": [1024]
           },
           "type": {
             "type": "string",
-            "description": "MIME type of the file.",
+            "description": "MIME type of the stored file. For a generated document (docx, pptx, pdf, xlsx) the stored file is the generation source, so this describes the source and not what `GET /files/{fileId}` serves — that endpoint returns the compiled artifact under the rendered document type.",
             "examples": ["text/csv"]
           },
           "key": {
@@ -2744,12 +2750,12 @@
           "size": {
             "type": "number",
             "minimum": 0,
-            "description": "File size in bytes.",
+            "description": "Size in bytes of the stored file. For a generated document (docx, pptx, pdf, xlsx) the stored file is the generation source rather than the rendered document, so this does not predict how many bytes `GET /files/{fileId}` returns — that endpoint serves the compiled artifact, which is typically much larger.",
             "examples": [1024]
           },
           "type": {
             "type": "string",
-            "description": "MIME type of the file.",
+            "description": "MIME type of the stored file. For a generated document (docx, pptx, pdf, xlsx) the stored file is the generation source, so this describes the source and not what `GET /files/{fileId}` serves — that endpoint returns the compiled artifact under the rendered document type.",
             "examples": ["text/csv"]
           },
           "key": {

apps/docs/openapi-v2-knowledge.json

@@ -1786,7 +1786,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"

apps/docs/openapi-v2-logs.json

@@ -288,7 +288,7 @@
       "get": {
         "operationId": "getLog",
         "summary": "Get Log",
-        "description": "Retrieve the diagnostic representation of a run, including its workflow snapshot, trace spans, final output, and cost. Trace spans are stored separately from the log row and are pruned on their own retention schedule: a run whose stored spans have aged out returns `traceSpans: []` rather than an error, so an empty array does not mean the run recorded no spans.",
+        "description": "Retrieve the diagnostic representation of a run, including its workflow snapshot, trace spans, final output, and cost. The returned `workflowState` snapshot has credential values redacted: OAuth credential references and secret (`password`) sub-block values are null, while `{{VAR}}` environment-variable references are preserved so consecutive snapshots stay diffable. Trace spans are stored separately from the log row and are pruned on their own retention schedule: a run whose stored spans have aged out returns `traceSpans: []` rather than an error, so an empty array does not mean the run recorded no spans.",
         "tags": ["Logs"],
         "parameters": [
           {
@@ -472,7 +472,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"
@@ -1194,7 +1194,19 @@
             "description": "Workflow snapshot associated with the execution."
           },
           "workflowState": {
-            "description": "Workflow state snapshot captured for the run."
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {},
+                "additionalProperties": {
+                  "description": "One top-level snapshot section — `blocks`, `edges`, `loops`, `parallels`, or `variables` — passed through as stored."
+                }
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Workflow graph snapshot captured for the run, with credential values redacted: `oauth-input` values and `password: true` sub-block values are null, while `{{VAR}}` environment-variable references are preserved. Null when no snapshot is retained."
           },
           "traceSpans": {
             "type": "array",

apps/docs/openapi-v2-resources.json

@@ -1923,7 +1923,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"

apps/docs/openapi-v2-tables.json

@@ -152,6 +152,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "413": {
             "$ref": "#/components/responses/PayloadTooLarge"
           },
@@ -213,6 +216,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "409": {
             "$ref": "#/components/responses/Conflict"
           },
@@ -1437,9 +1443,6 @@
           "404": {
             "$ref": "#/components/responses/NotFound"
           },
-          "413": {
-            "$ref": "#/components/responses/PayloadTooLarge"
-          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           },
@@ -2467,6 +2470,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "409": {
             "$ref": "#/components/responses/Conflict"
           },
@@ -3329,6 +3335,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "413": {
             "$ref": "#/components/responses/PayloadTooLarge"
           },
@@ -3694,7 +3703,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"
@@ -4981,22 +4990,20 @@
       "V2DeleteRowData": {
         "type": "object",
         "properties": {
-          "deletedCount": {
-            "type": "number",
-            "description": "Number of deleted rows."
-          },
-          "deletedRowIds": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
+          "id": {
+            "type": "string",
             "description": "Identifier of the deleted row."
+          },
+          "deleted": {
+            "type": "boolean",
+            "const": true,
+            "description": "Confirms that the row was deleted."
           }
         },
-        "required": ["deletedCount", "deletedRowIds"],
+        "required": ["id", "deleted"],
         "additionalProperties": false,
         "title": "Delete row data",
-        "description": "Result of a single-row deletion."
+        "description": "Row deletion acknowledgement."
       },
       "V2DeleteTableRowResponse": {
         "type": "object",
@@ -5009,7 +5016,7 @@
         "required": ["data"],
         "additionalProperties": false,
         "title": "Delete table row response",
-        "description": "Deleted row count and identifier."
+        "description": "Row deletion acknowledgement."
       },
       "V2UpsertRowData": {
         "type": "object",

apps/docs/openapi-v2-workflows.json

@@ -165,6 +165,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "413": {
             "$ref": "#/components/responses/PayloadTooLarge"
           },
@@ -182,7 +185,7 @@
       "post": {
         "operationId": "createWorkflowV2",
         "summary": "Create Workflow",
-        "description": "Create a workflow in a workspace root or canonical workflow folder.",
+        "description": "Create a workflow in a workspace root or canonical workflow folder. A workspace whose folder tree exceeds 10,000 folders is a 413, because the response needs the whole tree to render folder paths.",
         "tags": ["Workflows"],
         "requestBody": {
           "required": true,
@@ -226,9 +229,15 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "409": {
             "$ref": "#/components/responses/Conflict"
           },
+          "413": {
+            "$ref": "#/components/responses/PayloadTooLarge"
+          },
           "423": {
             "$ref": "#/components/responses/Locked"
           },
@@ -1046,6 +1055,16 @@
               "pattern": "^[A-Za-z0-9._:-]+$",
               "examples": ["run_8f14e45f-ceea-467f-a"]
             }
+          },
+          {
+            "name": "x-sim-via",
+            "in": "header",
+            "required": false,
+            "description": "Comma-separated workflow identifiers describing the workflow-to-workflow call chain that led to this request. Each hop appends its own workflow id, and Sim sets it automatically when one workflow calls another; supply it yourself only when relaying an existing chain. A chain already at the maximum depth is rejected with 409 and `error.details.code: \"CALL_CHAIN_DEPTH_EXCEEDED\"`, which is how runaway recursion between workflows is stopped.",
+            "schema": {
+              "description": "Comma-separated workflow identifiers describing the workflow-to-workflow call chain that led to this request. Each hop appends its own workflow id, and Sim sets it automatically when one workflow calls another; supply it yourself only when relaying an existing chain. A chain already at the maximum depth is rejected with 409 and `error.details.code: \"CALL_CHAIN_DEPTH_EXCEEDED\"`, which is how runaway recursion between workflows is stopped.",
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
@@ -1385,6 +1404,9 @@
           "404": {
             "$ref": "#/components/responses/NotFound"
           },
+          "409": {
+            "$ref": "#/components/responses/Conflict"
+          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           },
@@ -1511,9 +1533,6 @@
           "413": {
             "$ref": "#/components/responses/PayloadTooLarge"
           },
-          "423": {
-            "$ref": "#/components/responses/Locked"
-          },
           "429": {
             "$ref": "#/components/responses/RateLimited"
           },
@@ -1704,6 +1723,9 @@
           "403": {
             "$ref": "#/components/responses/Forbidden"
           },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
           "413": {
             "$ref": "#/components/responses/PayloadTooLarge"
           },
@@ -2075,7 +2097,7 @@
         }
       },
       "RunIdConflict": {
-        "description": "The run identifier is already associated with a different request.",
+        "description": "The run cannot be started. Two causes share this status, distinguished by `error.details.code`: `RUN_ID_CONFLICT` when the supplied `X-Run-Id` is already associated with a different request, and `CALL_CHAIN_DEPTH_EXCEEDED` when the incoming `X-Sim-Via` chain has already reached the maximum workflow-to-workflow call depth.",
         "headers": {
           "X-Run-Id": {
             "$ref": "#/components/headers/X-Run-Id"
@@ -3128,11 +3150,26 @@
           {
             "data": {
               "id": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
-              "isDeployed": true,
-              "deployedAt": "2026-06-12T10:30:00.000Z",
+              "isDeployed": false,
+              "deployedAt": null,
               "warnings": [],
               "activeDeployment": null,
-              "latestDeploymentAttempt": null,
+              "latestDeploymentAttempt": {
+                "id": "depop_01J8ZK3QW4M6X2R9T7B5C0V1",
+                "deploymentVersionId": "depver_01J8ZK3QW4M6X2R9T7B5C0V2",
+                "version": 3,
+                "action": "deploy",
+                "status": "preparing",
+                "isCurrent": true,
+                "readiness": {
+                  "webhooks": "pending",
+                  "schedules": "ready",
+                  "mcp": "not_applicable"
+                },
+                "requestedAt": "2026-06-12T10:30:00.000Z",
+                "activatedAt": null,
+                "error": null
+              },
               "version": 3
             }
           }
@@ -3352,11 +3389,26 @@
           {
             "data": {
               "id": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
-              "isDeployed": true,
-              "deployedAt": "2026-06-12T10:30:00.000Z",
+              "isDeployed": false,
+              "deployedAt": null,
               "warnings": [],
               "activeDeployment": null,
-              "latestDeploymentAttempt": null,
+              "latestDeploymentAttempt": {
+                "id": "depop_01J8ZK4RX5N7Y3S0U8D6E1W2",
+                "deploymentVersionId": "depver_01J8ZK4RX5N7Y3S0U8D6E1W3",
+                "version": 2,
+                "action": "activate",
+                "status": "activating",
+                "isCurrent": true,
+                "readiness": {
+                  "webhooks": "ready",
+                  "schedules": "ready",
+                  "mcp": "not_applicable"
+                },
+                "requestedAt": "2026-06-12T10:30:00.000Z",
+                "activatedAt": null,
+                "error": null
+              },
               "version": 2
             }
           }