Limits: the Console, Insights and the SDK

The limits of the Console’s control screens, Insights and its suggestions, the weekly digest and the TypeScript SDK.

The Console’s control screens (S26)

An org can’t be deleted from the Console. There is no route for it yet (owner only, the typed slug, a 7-day grace period you can cancel, an admin deed, and a purge worker). It is on the v0.2 backlog; until then an operator removes an org in the database.
Policy editing is single-writer. Two people editing the same policy each save their own version; the last save is the newest version. Versions never change and the diff shows exactly what each one changed.
The editor is plain text with diagnostics underlined from the server’s lint; it has no syntax colouring and no completion, and quick fixes exist only where the lint names the replacement (Did you mean "decision"?).
Readiness and the Witness card show what Deedglass last recorded. The readiness report runs when you ask (it connects to your database, at most 10 times a minute); the Witness card reads the decoder’s own record and never connects on page load, so it can be up to one decoder poll behind.

Insights (S27)

Insights never changes anything by itself. It reads and reports. No policy is activated or edited, and no action is blocked, unless a person does it; the only input into decisions is the opt-in anomaly facts, and what they do is written in the org’s own policy (INSIGHTS.md).
No machine learning and no learning across orgs. Anomaly checks are fixed thresholds over one agent’s own hourly counts in one org.
Baselines need 72 hours. A younger agent gets only the new_tool check.
A slow ramp can move a baseline. Growth a little at a time raises the mean and never reads as a spike. Budgets and rate limits are the hard controls; anomalies are signals.
No time-of-day seasonality. volume_spike compares an hour with all of the agent’s hours, so a batch packed into one or two hours can read as a spike; spread it, or expect findings.
Detection runs every 5 minutes per instance, over orgs with actions in the last 2 hours or with anomaly facts on. A finding can arrive up to 5 minutes late; with anomaly facts on, a detector more than anomaly_stale_after_minutes (15) behind makes every agent anomalous (detector_stale) until it catches up.
Replay re-decides the past; it doesn’t re-run it. Inputs that were pruned, never stored, in a newer format or unreadable are counted unknown, never guessed. SQL facts are recomputed with the current classifier; the result names both versions (REPLAY.md).
Replay limits: a window of at most 90 days and 1,000,000 actions, 10 replays created per org an hour, one running per org and two per instance. A replay whose runner dies restarts from zero.
Replay replays stored versions only over the API. Draft sources replay in the engine (S28’s suggestions); there is no HTTP route for them yet.
Stats use the budgets enforced now. budgets measures past days against the current enforced version’s day budgets; minute and hour budgets are left out. A window=7d answer can be up to 60 s old: repeats within a minute share the first request’s answer.
Simulated history is dev only and labelled. deedglass dev simulate refuses outside DEEDGLASS_ENV=dev, writes only into orgs it flagged simulated, scripts the tools and the Witness (witness.method: simulated), and runs actions one at a time, so it is no load test (SIMULATOR.md).

Suggestions, phrasing and the digest (S28)

Suggestions never change anything by themselves. Accepting creates a version in shadow; promoting it to enforce is a separate act by a person. internal/learn has no way to enforce (three tests pin it; SUGGESTIONS.md).
Template wording only, unless opted in. Claude rewords suggestions only when the operator set DEEDGLASS_ANTHROPIC_API_KEY and the org turned llm_phrasing on; a reply that fails any check is discarded (INSIGHTS_PRIVACY.md).
One org’s data, 14 days. Suggestions read only the org’s own decisions in the last 14 days, under the enforced version. No learning across orgs, and no machine learning: fixed thresholds over counts.
They can’t see intent. Approving every order update doesn’t say why people approved, or how closely they looked.
Budget replays show 0 changes. Replay keeps each action’s recorded usage, so it can’t show what a higher budget would have let through. Budget suggestions rest on the near-limit days.
Agent budgets are advice only. They live on the agent; the suggestion names the command and changes nothing.
The patcher refuses some files: flow-style rules or budgets lists and files that mix LF and CRLF line endings. deedglass policy fmt -w fixes both.
The schedule runs on every instance. Each serve checks every 5 minutes; learn_runs rows make the daily pass and the weekly digest happen once per org and period. A manual generate refuses a second pass for the same org on the same instance only; two instances can run one each, and the unique index keeps one open suggestion per change.
At most 10 open suggestions per org. The rest wait for a later pass.
The digest is numbers only, in English, weekly. No per-person schedule, no other languages.

The TypeScript SDK (S31)

wrapTool decides whether your code runs; it doesn’t sandbox what it does. Results your code reports are L0 (edge-reported); independent L1 and L2 checks need a Deedglass connector.
The Claude Agent SDK hooks see only the tools the SDK routes through hooks.
No framework call ids reach Deedglass: the 2026-10-01 API’s context takes only the client and the transport.
Agent keys are secrets, so the client refuses to start in a browser page unless told otherwise; short-lived browser tokens are a v2 item.
Offline verification checks seals and the chain, not whether the action was wise.

More limits

Limitations: the known limits in v1, and every part
Limits of connectors, the vault and egress
Limits of the attack suite and security pass