# Harness laws: jobs, limits, host and sandbox Shared rules (what a law secures, the adversary, H1 to H6): [harness.md](harness.md). ### S2. Jobs and limits One setting bounds every output: tool call, cell, job. A tool call journals only its start and settle. Limits: 1. Setting `Truncation`. `On(OutputLimits)` keeps at most the limits (bytes, lines, head or tail), counts the rest as dropped; default, 50 KiB and 2000 lines (defaults in `eukhe-types` only). `Off`: explicit opt-out, keeps every byte. 2. Bytes kept + bytes dropped = every byte produced; no silent loss. A cap drops nothing from output that fits. 3. A tool sets its value in `ToolRegistration.truncation`; the harness resolves a call's value in one place (`reporting_for`); a tool reads it via `ToolExecutionApi::truncation`. Under `Off` the final result is not truncated. 4. `BoundedOutput` (eukhe-core) takes its bound from the same value; past it, writes the full output to an artifact file. Under `Off`: keeps everything, no artifact. A tool call: 1. Journals two records: start (slot `running`, with its `execute` checkpoint) and settle (slot `done`, same commit as the result entry). No progress update is journaled: no output, details, diagnostics, usage. 2. While running, each progress update goes to the Harness's in-memory progress board, which sends each change to the conversation's live observers. `watch_events`: first snapshot has the last progress of each running call, then one `tool_execution_update` per change. No update after the call ends. 3. The settle carries every result byte, every warning, all usage. A call records usage while running with `ToolExecutionApi::usage`. An abort settles from the board, carrying the output the call reported, published or not. The board keeps the call until its settle commits, so an uncommitted settle and the abort settle after it read the same progress. 4. A crash loses the board: the interrupted call's partial live output, details, diagnostics and usage are lost; it settles from what is durable. A `Bounded…