@@ -68,8 +68,7 @@ describe('creating a Sim link from the sources popover', () => {
     const form = [...document.querySelectorAll('[role="dialog"]')].find((dialog) =>
       dialog.textContent?.includes('New link')
     )
-    expect(form).toBeDefined()
-    expect(document.querySelector<HTMLInputElement>('input[type="url"]')?.value).toBe(source.url)
+    expect(form?.querySelector<HTMLInputElement>('input[type="url"]')?.value).toBe(source.url)
     expect(row()).toBeNull()
   })
 })
@@ -6,6 +6,7 @@ import {
 } from '@sim/testing/mocks/billing-usage-reservation.mock'
 import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
 import { executionPayloadStoreMock } from '@sim/testing/mocks/execution-payload-store.mock'
+import { getMockLogger } from '@sim/testing/mocks/logger.mock'
 import {
   getMockPlatformEvent,
   telemetryMock,
@@ -774,6 +775,35 @@ describe('LoggingSession completion retries', () => {
     expect(rawLogs[128].output.value).toBe('row-128:raw-secret')
   })
 
+  it('labels a live block-log projection warning with the live phase', async () => {
+    const session = new LoggingSession('workflow-1', 'execution-live-phase', 'manual', 'req-1')
+    session.setResolvedSecretTraceRegistry(
+      createSecretRegistry([{ plaintext: 'raw-secret', replacement: '{{TOKEN}}' }])
+    )
+
+    await session.projectBlockLogsForDisplay([
+      {
+        blockId: 'function-1',
+        blockName: 'Function 1',
+        blockType: 'function',
+        startedAt: '2026-07-01T00:00:00.000Z',
+        endedAt: '2026-07-01T00:00:00.001Z',
+        durationMs: 1,
+        success: true,
+        executionOrder: 1,
+        output: { rows: Array.from({ length: 100_001 }, (_, index) => index) },
+        displayResolvedSecretTraceProvenance: createDisplayProvenance([
+          { plaintext: 'raw-secret', replacement: '{{TOKEN}}' },
+        ]),
+      },
+    ])
+
+    expect(getMockLogger('TraceSecretProjection').warn).toHaveBeenCalledWith(
+      'Omitting trace content that could not be sanitized',
+      expect.objectContaining({ executionId: 'execution-live-phase', phase: 'live' })
+    )
+  })
+
   it('projects a numeric Function result produced by a resolved numeric secret', async () => {
     const session = new LoggingSession('workflow-1', 'execution-numeric-secret', 'manual', 'req-1')
     session.setResolvedSecretTraceRegistry(
 
@@ -309,11 +309,13 @@ export class LoggingSession {
 
   private async projectRawTraceSpans(
     traceSpans: TraceSpan[],
-    registry = this.resolvedSecretTraceRegistry
+    registry = this.resolvedSecretTraceRegistry,
+    phase?: 'live'
   ): Promise<TraceSpan[]> {
     return projectTraceSpansForSecrets(traceSpans, {
       registry,
       store: this.getSecretProjectionStore(),
+      phase,
     })
   }
 
@@ -365,7 +367,8 @@ export class LoggingSession {
             output: envelope,
           },
         ],
-        registry
+        registry,
+        'live'
       )
       const projected = this.readProjectedDisplayContent(projectedSpan?.output)
       return this.shouldClearLiveDisplay(registry)
@@ -426,7 +429,8 @@ export class LoggingSession {
               ...(log.childTraceSpans ? { children: log.childTraceSpans } : {}),
             },
           ],
-          registry
+          registry,
+          'live'
         )
         const display = this.readProjectedDisplayContent(projectedLog?.output)
         displayLogs.push({
@@ -1503,7 +1507,7 @@ export class LoggingSession {
    * structure with no content rather than unprojected values.
    */
   async projectTraceSpansForLiveDisplay(traceSpans: TraceSpan[]): Promise<TraceSpan[]> {
-    return this.projectRawTraceSpans(traceSpans)
+    return this.projectRawTraceSpans(traceSpans, undefined, 'live')
   }
 
   async safeComplete(params: SessionCompleteParams = {}): Promise<void> {
 
@@ -125,6 +125,8 @@ export interface ProjectTraceSpansForSecretsOptions {
   store: LargeValueStoreContext
   /** Read-only display projections omit ref-backed content instead of writing another ref. */
   allowLargeValueWrites?: boolean
+  /** Labels warnings; defaults to `write`, or `read` when large-value writes are disabled. */
+  phase?: ProjectionPhase
   /**
    * Synthetic spans that each carry one display-envelope value, keyed by span id. Warnings name
    * the envelope field instead of the synthetic span and count it apart from real spans.
@@ -146,19 +148,22 @@ class TraceSecretProjectionError extends Error {
 class TraceContentBudgetError extends TraceSecretProjectionError {}
 
 /**
- * Identifies the run behind a projection warning. `phase` says whether the run was being written
- * to the log or a stored log was being read for display.
+ * Why a projection ran: `write` prepares the run's stored log, `read` displays a stored log, and
+ * `live` streams a running execution to a viewer without storing it.
  */
+type ProjectionPhase = 'write' | 'read' | 'live'
+
+/** Identifies the run behind a projection warning. */
 interface ProjectionLogDetails {
   executionId?: string
   workflowId?: string
   workspaceId?: string
-  phase: 'read' | 'write'
+  phase: ProjectionPhase
 }
 
 function projectionLogDetails(
   store: LargeValueStoreContext,
-  phase: ProjectionLogDetails['phase']
+  phase: ProjectionPhase
 ): ProjectionLogDetails {
   return {
     ...filterUndefined({
@@ -1713,7 +1718,10 @@ export async function projectTraceSpansForSecrets(
   options: ProjectTraceSpansForSecretsOptions
 ): Promise<TraceSpan[]> {
   const allowLargeValueWrites = options.allowLargeValueWrites !== false
-  const logDetails = projectionLogDetails(options.store, allowLargeValueWrites ? 'write' : 'read')
+  const logDetails = projectionLogDetails(
+    options.store,
+    options.phase ?? (allowLargeValueWrites ? 'write' : 'read')
+  )
   if (!options.registry?.isComplete()) {
     return structuralOnlyTraceSpans(traceSpans, logDetails)
   }