diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index d3f5c73..31cc64e 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.100.0"
+  ".": "0.101.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18f83bc..a80dda9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.101.0](https://github.com/kernel/kernel-node-sdk/compare/v0.100.0...v0.101.0) (2026-09-10)
+
+
+### Features
+
+* Add config analysis lifecycle guarantees ([2468a0a](https://github.com/kernel/kernel-node-sdk/commit/2468a0a74d674ccfce2f3f301a5ca904ac689372))
+* Brand origin TLS timeouts and classify provider failures ([1f63d03](https://github.com/kernel/kernel-node-sdk/commit/1f63d031eb68f79ea268200c035a07c4623004db))
+* Clarify proxy country defaults ([43f283c](https://github.com/kernel/kernel-node-sdk/commit/43f283c8aecfc74b8daa9145cc0b8fe7a65d7a47))
+* Expose vault access in organization entitlements ([0594999](https://github.com/kernel/kernel-node-sdk/commit/05949995501dcbccffed74f80e60a0447e0ef105))
+* Limit free organizations to three vaults ([5c17e2d](https://github.com/kernel/kernel-node-sdk/commit/5c17e2d9b5ecfbbb5c2a959c1ce1112d543fbdb1))
+* Populate safe failure reasons on invocation responses ([e86903d](https://github.com/kernel/kernel-node-sdk/commit/e86903d4934f27a5a332e151b5170a9c654e26c5))
+* Return vendor guidance with config registry recommendations ([548c574](https://github.com/kernel/kernel-node-sdk/commit/548c574ecd913aff68b3342012f4478316faf040))
+* Revert vendor guidance recommendations ([6dbf3c0](https://github.com/kernel/kernel-node-sdk/commit/6dbf3c0943160861cc7410f4958c885cff2c4077))
+* Support international ISP proxy countries ([833e524](https://github.com/kernel/kernel-node-sdk/commit/833e5240c705ab73d9160f0cd9c6117e2fe726d3))
+
 ## [0.100.0](https://github.com/kernel/kernel-node-sdk/compare/v0.99.0...v0.100.0) (2026-09-04)
 
 
diff --git a/package.json b/package.json
index a27ea1a..63ca6b1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.100.0",
+  "version": "0.101.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/resources/browsers/telemetry.ts b/src/resources/browsers/telemetry.ts
index bd08cde..be14c18 100644
--- a/src/resources/browsers/telemetry.ts
+++ b/src/resources/browsers/telemetry.ts
@@ -4338,13 +4338,16 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, proxy_unavailable, upstream_timeout, upstream_dns_failure,
-     * upstream_connect_failed. Unknown header values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
+     * values are dropped.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
+      | 'provider_rejected'
+      | 'origin_tls_timeout'
       | 'proxy_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'
diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index 8ac23ee..67f94a0 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -85,8 +85,13 @@ export interface Analysis {
   created_at: string;
 
   /**
-   * Present for failed or canceled analyses. Messages contain safe retry guidance
-   * rather than internal workflow errors.
+   * Deadline after which a still-running analysis becomes expired.
+   */
+  expires_at: string;
+
+  /**
+   * Present for failed, canceled, or expired analyses. Messages contain safe retry
+   * guidance rather than internal workflow errors.
    */
   failure: Shared.ErrorModel | null;
 
@@ -98,7 +103,7 @@ export interface Analysis {
   /**
    * Lifecycle status of a background analysis.
    */
-  status: 'running' | 'completed' | 'failed' | 'canceled';
+  status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 }
 
 export interface AnalysisSummary {
@@ -295,7 +300,8 @@ export namespace Proxy {
        */
       export interface IspProxyConfig {
         /**
-         * ISO 3166 country code. Defaults to US if not provided.
+         * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+         * to US if not provided.
          */
         country?: string;
       }
@@ -316,7 +322,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code.
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -346,7 +353,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -438,7 +446,7 @@ export interface RecommendationSummary {
   /**
    * Lifecycle status of the most recently requested analysis for this exact target.
    */
-  analysis_status: 'running' | 'completed' | 'failed' | 'canceled';
+  analysis_status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 
   /**
    * Most recent time the selected project requested an analysis for this exact
diff --git a/src/resources/invocations.ts b/src/resources/invocations.ts
index 0ba6cd8..300caac 100644
--- a/src/resources/invocations.ts
+++ b/src/resources/invocations.ts
@@ -197,8 +197,8 @@ export namespace InvocationStateEvent {
     finished_at?: string | null;
 
     /**
-     * Output produced by the action, rendered as a JSON string. This could be: string,
-     * number, boolean, array, object, or null.
+     * The action result or detailed failure output. Often a JSON-encoded value, but
+     * failures may contain plain text. May contain sensitive application data.
      */
     output?: string;
 
@@ -208,7 +208,13 @@ export namespace InvocationStateEvent {
     payload?: string;
 
     /**
-     * Status reason
+     * A nonempty, customer-safe summary of the recorded failure output, always present
+     * when status is failed and omitted otherwise, including in the first failed
+     * invocation_state event. Recognized messages receive a specific summary; other
+     * failures receive a generic summary. Message matching does not establish whether
+     * the failure originated in the platform or action code. Does not include raw
+     * action output or internal error details. Available for historical invocations as
+     * well. Human-readable text, not a stable identifier for retry logic.
      */
     status_reason?: string;
   }
@@ -231,13 +237,18 @@ export interface InvocationCreateResponse {
   status: 'queued' | 'running' | 'succeeded' | 'failed';
 
   /**
-   * The return value of the action that was invoked, rendered as a JSON string. This
-   * could be: string, number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise. Recognized messages receive a
+   * specific summary; other failures receive a generic summary. Message matching
+   * does not establish whether the failure originated in the platform or action
+   * code. Does not include raw action output or internal error details.
+   * Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -280,8 +291,8 @@ export interface InvocationRetrieveResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -291,7 +302,13 @@ export interface InvocationRetrieveResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -334,8 +351,8 @@ export interface InvocationUpdateResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -345,7 +362,13 @@ export interface InvocationUpdateResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -388,8 +411,8 @@ export interface InvocationListResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -399,7 +422,13 @@ export interface InvocationListResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
diff --git a/src/resources/organization/entitlements.ts b/src/resources/organization/entitlements.ts
index 1a5c70c..3c29cf5 100644
--- a/src/resources/organization/entitlements.ts
+++ b/src/resources/organization/entitlements.ts
@@ -57,6 +57,12 @@ export namespace OrgEntitlements {
     profiles: Features.Profiles;
 
     proxy_bypass_hosts: Features.ProxyBypassHosts;
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    vaults: Features.Vaults;
   }
 
   export namespace Features {
@@ -176,6 +182,17 @@ export namespace OrgEntitlements {
        */
       enabled: boolean;
     }
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    export interface Vaults {
+      /**
+       * Whether the organization is entitled to use this feature.
+       */
+      enabled: boolean;
+    }
   }
 
   export interface Limits {
@@ -195,6 +212,12 @@ export namespace OrgEntitlements {
      * Effective organization-wide concurrent app invocation ceiling.
      */
     max_concurrent_invocations: number;
+
+    /**
+     * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+     * unlimited. The vaults feature flag still controls access.
+     */
+    max_vaults: number | null;
   }
 
   export interface Plan {
diff --git a/src/resources/organization/limits.ts b/src/resources/organization/limits.ts
index 15ca385..98ed542 100644
--- a/src/resources/organization/limits.ts
+++ b/src/resources/organization/limits.ts
@@ -9,7 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's effective limits and managed auth usage.
+   * Get the organization's effective limits and managed auth and vault usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -39,6 +39,12 @@ export interface OrgLimits {
    */
   max_auth_connections: number | null;
 
+  /**
+   * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+   * unlimited.
+   */
+  max_vaults: number | null;
+
   /**
    * Smallest health_check_interval the organization's plan accepts on a managed auth
    * connection. Requests below this are rejected with 400. Existing connections
@@ -46,6 +52,11 @@ export interface OrgLimits {
    */
   min_health_check_interval_seconds: number;
 
+  /**
+   * Current non-deleted vault count across all projects in the organization.
+   */
+  vaults_used: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects
diff --git a/src/resources/proxies.ts b/src/resources/proxies.ts
index 9b1dfff..f366374 100644
--- a/src/resources/proxies.ts
+++ b/src/resources/proxies.ts
@@ -183,7 +183,8 @@ export namespace ProxyCreateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -204,7 +205,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -234,7 +236,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -344,7 +347,8 @@ export namespace ProxyRetrieveResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -365,7 +369,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -395,7 +400,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -505,7 +511,8 @@ export namespace ProxyUpdateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -526,7 +533,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -556,7 +564,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -666,7 +675,8 @@ export namespace ProxyListResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -687,7 +697,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -717,7 +728,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -827,7 +839,8 @@ export namespace ProxyCheckResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -848,7 +861,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -878,7 +892,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -968,7 +983,8 @@ export namespace ProxyCreateParams {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -989,7 +1005,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -1019,7 +1036,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
diff --git a/src/resources/vaults/vaults.ts b/src/resources/vaults/vaults.ts
index 3031f0b..8d0e7df 100644
--- a/src/resources/vaults/vaults.ts
+++ b/src/resources/vaults/vaults.ts
@@ -60,7 +60,9 @@ export class Vaults extends APIResource {
   }
 
   /**
-   * Create or retrieve a vault by immutable name
+   * Free organizations can store up to 3 non-deleted vaults across all projects.
+   * Paid plans and active trials have no vault cap. Retrieving an existing vault by
+   * name succeeds even at the limit.
    */
   upsert(body: VaultUpsertParams, options?: RequestOptions): APIPromise<Vault> {
     return this._client.post('/vaults', { body, ...options });
diff --git a/src/version.ts b/src/version.ts
index 60f4455..bdc4cd8 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.100.0'; // x-release-please-version
+export const VERSION = '0.101.0'; // x-release-please-version