diff --git a/src/agents/pi-embedded-subscribe.handlers.lifecycle.ts b/src/agents/pi-embedded-subscribe.handlers.lifecycle.ts
index 4c6d23c0243..926d2818075 100644
--- a/src/agents/pi-embedded-subscribe.handlers.lifecycle.ts
+++ b/src/agents/pi-embedded-subscribe.handlers.lifecycle.ts
@@ -5,11 +5,7 @@ import {
   buildTextObservationFields,
   sanitizeForConsole,
 } from "./pi-embedded-error-observation.js";
-import {
-  classifyFailoverReason,
-  classifyProviderRuntimeFailureKind,
-  formatAssistantErrorText,
-} from "./pi-embedded-helpers.js";
+import { classifyFailoverReason, formatAssistantErrorText } from "./pi-embedded-helpers.js";
 import {
   consumePendingToolMediaReply,
   hasAssistantVisibleReply,
@@ -55,10 +51,6 @@ export function handleAgentEnd(ctx: EmbeddedPiSubscribeContext): void | Promise<
     const failoverReason = classifyFailoverReason(rawError ?? "", {
       provider: lastAssistant.provider,
     });
-    const providerRuntimeFailureKind = classifyProviderRuntimeFailureKind({
-      message: rawError ?? "",
-      provider: lastAssistant.provider,
-    });
     const errorText = (friendlyError || lastAssistant.errorMessage || "LLM request failed.").trim();
     const observedError = buildApiErrorObservationFields(rawError, {
       provider: lastAssistant.provider,
@@ -83,7 +75,6 @@ export function handleAgentEnd(ctx: EmbeddedPiSubscribeContext): void | Promise<
       model: lastAssistant.model,
       provider: lastAssistant.provider,
       ...observedError,
-      providerRuntimeFailureKind,
       consoleMessage: `embedded run agent end: runId=${safeRunId} isError=true model=${safeModel} provider=${safeProvider} error=${safeErrorText}${rawErrorConsoleSuffix}`,
     });
   } else {
diff --git a/src/auto-reply/reply/commands-system-prompt.ts b/src/auto-reply/reply/commands-system-prompt.ts
index 11ca2dd3a57..22773d48aef 100644
--- a/src/auto-reply/reply/commands-system-prompt.ts
+++ b/src/auto-reply/reply/commands-system-prompt.ts
@@ -111,6 +111,14 @@ export async function resolveCommandsSystemPromptBundle(
       defaultModel: defaultModelLabel,
     },
   });
+  const fullAccessState = resolveEmbeddedFullAccessState({
+    sandboxEnabled: true,
+    execElevated: {
+      enabled: params.elevated.enabled,
+      allowed: params.elevated.allowed,
+      defaultLevel: (params.resolvedElevatedLevel ?? "off") as "on" | "off" | "ask" | "full",
+    },
+  });
   const sandboxInfo = sandboxRuntime.sandboxed
     ? {
         enabled: true,
@@ -119,18 +127,10 @@ export async function resolveCommandsSystemPromptBundle(
         elevated: {
           allowed: params.elevated.allowed,
           defaultLevel: (params.resolvedElevatedLevel ?? "off") as "on" | "off" | "ask" | "full",
-          fullAccessAvailable: resolveEmbeddedFullAccessState({
-            sandboxEnabled: true,
-            execElevated: {
-              enabled: params.elevated.enabled,
-              allowed: params.elevated.allowed,
-              defaultLevel: (params.resolvedElevatedLevel ?? "off") as
-                | "on"
-                | "off"
-                | "ask"
-                | "full",
-            },
-          }).available,
+          fullAccessAvailable: fullAccessState.available,
+          ...(fullAccessState.blockedReason
+            ? { fullAccessBlockedReason: fullAccessState.blockedReason }
+            : {}),
         },
       }
     : { enabled: false };
diff --git a/src/auto-reply/reply/get-reply-run.ts b/src/auto-reply/reply/get-reply-run.ts
index fba2b155a8c..1fe49f7c240 100644
--- a/src/auto-reply/reply/get-reply-run.ts
+++ b/src/auto-reply/reply/get-reply-run.ts
@@ -228,7 +228,7 @@ export async function runPreparedReply(
   const fullAccessState = resolveEmbeddedFullAccessState({
     sandboxEnabled: resolveSandboxRuntimeStatus({
       cfg,
-      sessionKey: ctx.SessionKey,
+      sessionKey,
     }).sandboxed,
     execElevated: {
       enabled: elevatedEnabled,