@@ -82,6 +82,6 @@ export async function outputLimits() {
     await load(path.join(ConfigManaged.managedConfigDir(), name))
   }
   const preferences = await ConfigManaged.readManagedPreferences().catch(() => undefined)
-  if (preferences) await apply(preferences.text, { source: preferences.source, dir: path.dirname(preferences.source) })
+  if (preferences) await apply(preferences.text, { source: preferences.source, dir: path.dirname(preferences.source.replace(/^mobileconfig:/, "")) })
   return limits
 }
@@ -265,8 +265,9 @@ export async function startDaemon(options: DaemonOptions): Promise<Daemon> {
           // Release DuckDB/SQLite file locks once idle, before replying, so a client running `dbt build` next finds the file free.
           // A request that arrives meanwhile waits for the release (see `handle`). Whichever request
           // finishes last releases, so a run that finished while a status was in flight is covered.
-          // A stop is answered at once; the daemon then shuts down.
-          if (inflight === 0 && options.releaseFiles && dirty && !stopRequest) {
+          // A stop is answered at once; the daemon then shuts down, and a run that finishes after it
+          // neither releases nor re-arms (stop() closes the runner).
+          if (inflight === 0 && options.releaseFiles && dirty && !stopRequest && !stopping) {
             dirty = false
             const release = options.releaseFiles().catch(() => {})
             releasing = release
@@ -276,7 +277,10 @@ export async function startDaemon(options: DaemonOptions): Promise<Daemon> {
           if (socket.destroyed) afterReply?.()
           else socket.write(JSON.stringify(response) + "\n", () => afterReply?.())
         })
-        .finally(arm)
+        // After stop() nothing re-arms the idle timer.
+        .finally(() => {
+          if (!stopping) arm()
+        })
     })
   })
 
@@ -305,6 +309,9 @@ export async function startDaemon(options: DaemonOptions): Promise<Daemon> {
           try {
             chmodSync(file, 0o600)
           } catch (error) {
+            // Leave nothing bound behind: no socket file and no listening server.
+            server.close()
+            removeSocket(file)
             return reject(error)
           }
         }
 
@@ -1,6 +1,7 @@
 import { Effect } from "effect"
 import type { Tool } from "../../tool/tool"
 import { classifyAndCheck } from "../tools/sql-classify"
+import * as Registry from "../native/connections/registry"
 
 /** Permission kinds the data tools raise for reads; anything else is a write and needs `--allow-write`. */
 export const READ_PERMISSIONS: ReadonlySet<string> = new Set([
@@ -10,10 +11,21 @@ export const READ_PERMISSIONS: ReadonlySet<string> = new Set([
   "answer_commit",
 ])
 
-// Same statements the agent's `safetyDenials` rules refuse (agent/agent.ts), found by the SQL classifier
-// so leading comments and later statements of a multi-statement pattern are seen too.
-export function isBlockedStatement(pattern: string): boolean {
-  return classifyAndCheck(pattern).blocked
+const BLOCKED_STATEMENT = /^\s*(drop\s+(database|schema)\b|truncate\b)/i
+
+// Same statements the agent's `safetyDenials` rules refuse (agent/agent.ts). With the warehouse's
+// dialect the SQL classifier finds them past leading comments and in later statements; without
+// one, quoting differs by dialect (dollar quotes, backticks), so only the leading statement is
+// checked rather than risk an unoverridable denial of a valid read.
+export function isBlockedStatement(pattern: string, dialect?: string): boolean {
+  return dialect ? classifyAndCheck(pattern, dialect).blocked : BLOCKED_STATEMENT.test(pattern)
+}
+
+function dialectOf(metadata: unknown): string | undefined {
+  const warehouse = (metadata as { warehouse?: unknown } | undefined)?.warehouse
+  return typeof warehouse === "string" && warehouse
+    ? (Registry.canonicalType(Registry.getConfig(warehouse)?.type) ?? undefined)
+    : undefined
 }
 
 export function denied(permission: string, retry = "Re-run"): Error {
@@ -25,8 +37,9 @@ export function denied(permission: string, retry = "Re-run"): Error {
  * kind is denied unless writes were enabled, and blocked destructive statements are refused either way.
  */
 export function askFor(allowWrite: boolean, retry = "Re-run"): Tool.Context["ask"] {
-  return ({ permission, patterns }) => {
-    if (patterns?.some(isBlockedStatement)) {
+  return ({ permission, patterns, metadata }) => {
+    const dialect = dialectOf(metadata)
+    if (patterns?.some((pattern) => isBlockedStatement(pattern, dialect))) {
       return Effect.die(
         new Error(`Permission denied: ${permission}. DROP DATABASE, DROP SCHEMA and TRUNCATE are blocked for safety. This cannot be overridden.`),
       )
 
@@ -113,7 +113,7 @@ export const DataDiffTool = Tool.define("data_diff", {
       if (!result.success) {
         return {
           title: "Data diff: ERROR",
-          metadata: { success: false, steps: result.steps },
+          metadata: { success: false, steps: result.steps, error: result.error },
           output: `Data diff failed: ${result.error}`,
         }
       }
 
@@ -3,11 +3,11 @@ import { maskSql, tokenizeSql } from "./sql-tokenize"
 import { sqlFunctionCalls } from "./sql-functions"
 import { hasSideEffectFunction } from "./sql-function-policy"
 
-/** The masked SQL when it is one complete read-only query that is safe to embed: the
+/** The masked SQL and its trimmed body when it is one complete read-only query that is safe to embed: the
  * classifier reads it as a non-blocked read, its parentheses balance (so it cannot close a
  * CTE or subquery it is placed in), it has no statement separator, and it calls no function
  * that writes or runs SQL (dynamic query() included). Undefined otherwise. */
-function readOnlyBody(sql: string, dialect?: string): string | undefined {
+function readOnlyBody(sql: string, dialect?: string): { masked: string; body: string } | undefined {
   const { queryType, blocked } = classifyAndCheck(sql, dialect)
   const { tokens, complete } = tokenizeSql(sql, dialect)
   const masked = maskSql(tokens)
@@ -31,7 +31,7 @@ function readOnlyBody(sql: string, dialect?: string): string | undefined {
     balanced &&
     depth === 0 &&
     !body.includes(";")
-  return safe ? body : undefined
+  return safe ? { masked, body } : undefined
 }
 
 /** Throws unless sql is one read-only query that is safe to embed in a larger query. */
@@ -44,9 +44,10 @@ export function requireReadOnlyQuery(sql: string, dialect?: string): void {
  * Stricter than requireReadOnlyQuery: sql_check also requires SELECT or WITH and refuses
  * write keywords anywhere, even where the parser reports a query. */
 export function readSql(sql: string, dialect?: string): string {
-  const body = readOnlyBody(sql, dialect)
+  const checked = readOnlyBody(sql, dialect)
+  const body = checked?.body ?? ""
   if (
-    body === undefined ||
+    checked === undefined ||
     !/^(SELECT|WITH)\b/i.test(body) ||
     /\b(INSERT|UPDATE|DELETE|MERGE|DROP|ALTER|CREATE|TRUNCATE|COPY|ATTACH|DETACH|PRAGMA|VACUUM|CALL|DO|INTO|INSTALL|LOAD|EXPORT|IMPORT|GRANT|REVOKE)\b/i.test(
       body,
@@ -57,7 +58,6 @@ export function readSql(sql: string, dialect?: string): string {
       "This operation only accepts a single read-only SELECT (or WITH ... SELECT); it never writes or fixes data.",
     )
   }
-  const masked = maskSql(tokenizeSql(sql, dialect).tokens)
-  const semicolon = masked.indexOf(";")
+  const semicolon = checked.masked.indexOf(";")
   return semicolon < 0 ? sql : sql.slice(0, semicolon) + sql.slice(semicolon + 1)
 }
@@ -643,6 +643,9 @@ function resolveStepRefs(
       if (!table) throw new Error(`${match}: storing step "${ref}" in scratch failed.`)
       return table
     }
+    // A caller limit above the bound returns more rows without marking the step truncated.
+    if (source.rows.length > MAX_BOUND_ROWS)
+      throw new Error(`${match}: step "${ref}" has more than ${MAX_BOUND_ROWS} rows; filter or aggregate it first.`)
     const index = source.columns.findIndex((name) => name.toLowerCase() === column.toLowerCase())
     // Some drivers return no column names for an empty result; an empty step is an empty list either way.
     if (index < 0 && !source.rows.length && !source.columns.length) return isMongoWarehouse(warehouse) ? "null" : "NULL"
 
@@ -101,6 +101,7 @@ describe("analyst default reasoning effort", () => {
     const wrap = (options: Record<string, any>) => ({ agent: analyst, model: { ...opus, options } })
     const defaults = analystEffortOptions({ agent: analyst, model: opus })
     expect(analystEffortOptions(wrap({ modelParams: null }))).toEqual(defaults)
+    expect(analystEffortOptions(wrap({ modelParams: "x" }))).toEqual(defaults)
     expect(analystEffortOptions(wrap({ output_config: null }))).toEqual(defaults)
     expect(analystEffortOptions(wrap({ output_config: { format: "json" } }))).toEqual(defaults)
     expect(analystEffortOptions(wrap({ output_config: { effort: "low" } }))).toEqual({})
 
@@ -1,10 +1,11 @@
 // altimate_change start — MCP output limits resolve like the agent's config loader
-import { afterEach, beforeEach, expect, test } from "bun:test"
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test"
 import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises"
 import os from "node:os"
 import path from "node:path"
 import { outputLimits } from "../../../src/altimate/mcp-server/output-settings"
 import { MAX_BYTES, MAX_LINES } from "../../../src/tool/truncate-core"
+import { ConfigManaged } from "../../../src/config/managed"
 
 const VARS = [
   "OPENCODE_CONFIG",
@@ -109,4 +110,20 @@ test("an unreadable config path does not stop startup", async () => {
   await writeFile(path.join(repo, "opencode.jsonc"), output({ max_lines: 8 }))
   expect(await outputLimits()).toEqual({ maxLines: 8, maxBytes: MAX_BYTES })
 })
+
+test("managed preferences resolve {file:...} next to their plist", async () => {
+  const prefs = path.join(root, "Managed Preferences", "user")
+  await mkdir(prefs, { recursive: true })
+  await writeFile(path.join(prefs, "lines.txt"), "7")
+  const spy = spyOn(ConfigManaged, "readManagedPreferences").mockResolvedValue({
+    text: '{"tool_output":{"max_lines":{file:lines.txt}}}',
+    source: `mobileconfig:${path.join(prefs, "com.example.plist")}`,
+  } as never)
+  try {
+    expect((await outputLimits()).maxLines).toBe(7)
+  } finally {
+    spy.mockRestore()
+  }
+})
+
 // altimate_change end
@@ -396,6 +396,41 @@ describe("release ordering", () => {
     expect((await reply)?.status).toBe("ok")
   })
 
+  test("a run that finishes after stop releases nothing", async () => {
+    const dir = await temp()
+    const file = path.join(dir, "d.sock")
+    const runner = fakeRunner()
+    let finishRun!: () => void
+    const gate = new Promise<void>((resolve) => (finishRun = resolve))
+    let running!: () => void
+    const begun = new Promise<void>((resolve) => (running = resolve))
+    const run = runner.run.bind(runner)
+    runner.run = async (...args: Parameters<typeof run>) => {
+      running()
+      await gate
+      return run(...args)
+    }
+    let releases = 0
+    const daemon = await startDaemon({
+      directory: dir,
+      version: "1",
+      runner,
+      file,
+      idleMs: 60_000,
+      releaseFiles: async () => {
+        releases++
+      },
+    })
+    cleanups.push(() => daemon.stop())
+    const pending = send(file, { id: "1", name: "t" }).catch(() => undefined)
+    await begun
+    expect((await send(file, { id: "x", op: "stop" }))?.output).toBe("stopping")
+    finishRun()
+    await pending
+    await daemon.closed
+    expect(releases).toBe(0)
+  })
+
   test.skipIf(process.platform === "win32")("the socket is private to its owner", async () => {
     const { file } = await start()
     expect(statSync(file).mode & 0o777).toBe(0o600)
 
@@ -165,8 +165,24 @@ describe("ask handler", () => {
     expect(Exit.isFailure(ask(true, "bash", ["truncate table x"]))).toBe(true)
     expect(isBlockedStatement("  Drop Schema s")).toBe(true)
     expect(isBlockedStatement("DROP TABLE t")).toBe(false)
-    expect(isBlockedStatement("/* c */ DROP SCHEMA s")).toBe(true)
-    expect(isBlockedStatement("SELECT 1; TRUNCATE t")).toBe(true)
+  })
+
+  test("with the warehouse dialect, later statements and leading comments are checked too", () => {
+    expect(isBlockedStatement("/* c */ DROP SCHEMA s", "postgres")).toBe(true)
+    expect(isBlockedStatement("SELECT 1; TRUNCATE t", "postgres")).toBe(true)
+    // Dollar-quoted text is a string in Postgres, not a second statement.
+    expect(isBlockedStatement("SELECT $q$; TRUNCATE staging$q$", "postgres")).toBe(false)
+    // Without a dialect quoting is unknown, so only the leading statement counts.
+    expect(isBlockedStatement("SELECT $q$; TRUNCATE staging$q$")).toBe(false)
+    Registry.setConfigs({ pg: { type: "postgres" } as any })
+    try {
+      const askWith = (patterns: string[]) =>
+        Effect.runSyncExit(askFor(false)({ permission: "sql_execute", patterns, always: [], metadata: { warehouse: "pg" } }))
+      expect(Exit.isFailure(askWith(["SELECT 1; TRUNCATE t"]))).toBe(true)
+      expect(Exit.isSuccess(askWith(["SELECT $q$; TRUNCATE staging$q$"]))).toBe(true)
+    } finally {
+      Registry.reset()
+    }
   })
 })
 
@@ -228,6 +244,7 @@ describe("data_diff write-carrying inputs", () => {
           source_warehouse: "wh",
           [field]: value,
         })
+        expect(result.status).toBe("error")
         expect(JSON.stringify(result)).toContain("read-only inputs")
       } finally {
         Registry.reset()
Original file line number	Diff line number	Diff line change
`@@ -82,6 +82,6 @@ export async function outputLimits() {`
`82`	`82`	`await load(path.join(ConfigManaged.managedConfigDir(), name))`
`83`	`83`	`}`
`84`	`84`	`const preferences = await ConfigManaged.readManagedPreferences().catch(() => undefined)`
`85`		`- if (preferences) await apply(preferences.text, { source: preferences.source, dir: path.dirname(preferences.source) })`
	`85`	`+ if (preferences) await apply(preferences.text, { source: preferences.source, dir: path.dirname(preferences.source.replace(/^mobileconfig:/, "")) })`
`86`	`86`	`return limits`
`87`	`87`	`}`
Original file line number	Diff line number	Diff line change
`@@ -113,7 +113,7 @@ export const DataDiffTool = Tool.define("data_diff", {`
`113`	`113`	`if (!result.success) {`
`114`	`114`	`return {`
`115`	`115`	`title: "Data diff: ERROR",`
`116`		`- metadata: { success: false, steps: result.steps },`
	`116`	`+ metadata: { success: false, steps: result.steps, error: result.error },`
`117`	`117`	output: `Data diff failed: ${result.error}`,
`118`	`118`	`}`
`119`	`119`	`}`